Aspera Shares CVE-2025-66486

The risk profile is constrained by multiple limiting factors despite a moderate CVSS score. Attack vector is network-accessible (AV:N) and complexity is low (AC:L), but the attack requires high-privilege authentication (PR:H) - meaning only administrators or similarly privileged users can inject payloads. User interaction (UI:R) is mandatory, as victims must view the injected HTML to trigger execution. The CVSS impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact. While the scope is changed (S:C), indicating cross-site security impact, the low severity ratings and authentication barrier substantially reduce real-world exploitation probability. EPSS and public exploit availability data are not provided, but the established patch and low-complexity exploit vector (once authenticated) suggest this is a real issue for organizations where high-privilege users are not fully trusted or where account compromise is a concern. This is not a critical vulnerability, but organizations with restrictive privilege models and multi-factor authentication should prioritize patching.

A disgruntled high-privilege administrator in an IBM Aspera Shares deployment injects a malicious HTML payload (e.g., an iframe or redirect) into a shared file name or comment field. When other users view the file or comment, the injected HTML executes in their browsers under the hosting site's security context, potentially stealing session cookies or sensitive information. Alternatively, if an attacker compromises a high-privilege account, they could perform the same injection to compromise additional users without requiring direct code execution privileges on the server.