Stored Cross-Site Scripting Vulnerability in IBM Aspera Shares
CVE-2025-66484

5.5MEDIUM

Key Information:

Vendor

IBM
Status
Aspera Shares
Vendor
CVE Published:
1 April 2026

What is CVE-2025-66484?

IBM Aspera Shares versions 1.9.9 through 1.11.0 are affected by a stored cross-site scripting vulnerability that enables an attacker to inject arbitrary JavaScript code into the web interface. This vulnerability can be exploited to modify the site's functionality and may result in the unauthorized disclosure of user credentials during a trusted session, posing a significant risk to user security and confidentiality.

Affected Version(s)

Aspera Shares 1.9.9 <= 1.11.0

References

https://www.ibm.com/support/pages/node/7267848
vendor-advisorypatch

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.