HTTP Header Injection Vulnerability in IBM Aspera Orchestrator
CVE-2025-13213

5.4MEDIUM

Key Information:

Vendor

IBM
Status
Aspera Orchestrator
Vendor
CVE Published:
10 March 2026

What is CVE-2025-13213?

IBM Aspera Orchestrator versions 3.0.0 through 4.1.2 are susceptible to an HTTP header injection vulnerability due to insufficient validation of input within the HOST headers. This flaw can potentially enable attackers to execute various techniques such as cross-site scripting, cache poisoning, or session hijacking, posing significant risks to system integrity and user data safety.

Affected Version(s)

Aspera Orchestrator 3.0.0 <= 4.1.2

References

https://www.ibm.com/support/pages/node/7263083
vendor-advisorypatch

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.