Stored Cross-Site Scripting Flaw in IBM Aspera Shares Product
CVE-2024-56472

6.4MEDIUM

Key Information:

Vendor
IBM
Status
Aspera Shares
Vendor
CVE Published:
5 February 2025

Summary

IBM Aspera Shares versions 1.9.0 to 1.10.0 PL6 exhibit a vulnerability that allows authenticated users to inject arbitrary JavaScript into the Web UI. This dangerous flaw could allow attackers to manipulate the platform's normal operations, potentially leading to unauthorized access and the disclosure of sensitive information during an active session.

Affected Version(s)

Aspera Shares 1.9.0 <= 1.10.0 PL6

References

https://www.ibm.com/support/pages/node/7182490
vendor-advisory

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.