Aspera Shares CVE-2025-66485

The CVSS score of 5.4 reflects moderate risk with network-based attack vector, low complexity, and requirement for authenticated access (PR:L). The limited scope (S:U) and lack of availability impact reduce severity. EPSS probability data is not provided, but the authentication requirement significantly lowers real-world risk compared to unauthenticated vectors. KEV status indicates no confirmed active exploitation at time of analysis, and no public exploit code is documented. From an SSVC perspective, the automation potential is moderate-header injection attacks can be automated but require valid credentials. The technical impact is limited to information disclosure and integrity (no availability impact), making this a lower-priority vulnerability for organizations with restricted admin access. However, environments with permissive internal user access or service-to-service authentication should prioritize patching.

An authenticated user with legitimate access to IBM Aspera Shares submits a crafted request with an injected HOST header containing JavaScript or cache-control directives. If the vulnerable application echoes the HOST header in a response without sanitization, the injected payload could execute in the context of other users' browsers (XSS), poison intermediate caches to serve malicious content to subsequent users, or manipulate session tokens. The requirement for authentication limits exposure to insider threats or compromised accounts.