Potential Password Impersonation Vulnerability in IBM Aspera Shares 1.10.0 PL2

CVE-2023-38018

What is CVE-2023-38018?

IBM Aspera Shares 1.10.0 PL2 contains a session management flaw that fails to invalidate user sessions when a password change occurs. This vulnerability could be exploited by an authenticated user to impersonate another user on the system, potentially leading to unauthorized access to sensitive information and operations. The lack of appropriate session invalidation represents a significant security risk, as it undermines the integrity of user authentication processes. Organizations using affected versions are advised to apply available security updates to mitigate this risk.

References