IBM Aspera Faspex CVE-2025-36230

Exploitation requires an authenticated Faspex 5 account (CVSS PR:L - a low-privileged user suffices) to submit attacker-controlled input into a field that is later rendered as HTML, plus a second user actually viewing that injected content (CVSS UI:R) for the payload to execute. The impact is confined to the victim's browser session within the Faspex site's security context (S:C, C:L/I:L), so there is no server-side code execution or data destruction. Limiting factors that reduce realistic risk: the attacker cannot exploit this as an unauthenticated outsider, the victim must be social-engineered or routinely browse to the affected view, and the affected deployments are restricted to Faspex 5 versions 5.0.0 through 5.0.14.1 - upgraded or Faspex 4 instances are not in scope.

This is a moderate-severity stored/reflected HTML injection (CWE-80) issue with a CVSS 3.1 score of 5.4, and the signals consistently point to a genuine-but-not-urgent priority rather than a critical emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network reachability with low attack complexity, but two meaningful friction points cap real-world risk: PR:L means the attacker must already hold a low-privileged Faspex account, and UI:R means a victim must actually view the injected content before code executes. The scope change (S:C) and the dual C:L/I:L impacts correctly capture that injected markup runs in the victim's browser within the trusted security context of the hosting site, enabling session/UI manipulation but not full system compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - the real-world risk is driven by the theoretical ease of injection against authenticated users, not by observed attacks. EPSS and KEV data are MISSING rather than low, so exploitation likelihood cannot be quantified from this data set; treat the absence as unknown, not as confirmation of low interest. Overall: a legitimate issue to patch on a normal cadence, not a drop-everything priority.

A remote attacker with a low-privileged Faspex 5 account submits content (e.g., a package name, message, or metadata field) containing malicious HTML/script markup that is stored by the server. When another user - potentially an administrator - opens the page rendering that content, the injected markup executes in their browser within the trusted Faspex origin, enabling session-token theft, UI spoofing, or actions performed as the victim. No public proof-of-concept was identified in the provided data, and successful exploitation depends on the victim viewing the attacker-controlled content.