EUVD-2025-209186CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4Tags
Description
IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
Analysis
IBM Aspera Shares 1.9.9 through 1.11.0 lacks proper rate limiting on authenticated user email submissions, allowing high-privilege users to trigger email flooding or denial of service conditions. The vulnerability requires authentication at the admin or high-privilege level and results in service availability degradation rather than data compromise. EPSS exploitation probability is low (2.7 CVSS, high privilege requirement), and no public exploit code or active exploitation has been identified at time of analysis.
Technical Context
The vulnerability exists in IBM Aspera Shares email functionality and stems from insufficient rate-limiting controls (CWE-770: Allocation of Resources Without Limits or Throttling). Aspera Shares is IBM's enterprise file-sharing platform. The root cause is the absence of per-user, per-action frequency thresholds on outbound email operations, allowing an authenticated high-privilege user (PR:H in CVSS) to submit unbounded email requests. This can exhaust email queue resources, trigger mail server throttling, or generate enough volume to impact the platform's ability to process legitimate email notifications and communications.
Affected Products
IBM Aspera Shares versions 1.9.9 through 1.11.0 (CPE: cpe:2.3:a:ibm:aspera_shares:*:*:*:*:*:*:*:*) are affected. The vulnerability is present across all minor and patch versions within the 1.9.9-1.11.0 range. Versions prior to 1.9.9 and versions after 1.11.0 (including any 1.12.0 or later releases) are not listed as affected by this specific issue. Refer to the IBM support advisory at https://www.ibm.com/support/pages/node/7267848 for definitive version confirmation and patch details.
Remediation
Vendor-released patch is available from IBM. Organizations should upgrade IBM Aspera Shares to a patched version beyond 1.11.0 as specified in the IBM security advisory (https://www.ibm.com/support/pages/node/7267848). As an interim compensating control pending patching, restrict email-sending privileges within Aspera Shares to only necessary administrative users, implement network-level rate limiting on outbound SMTP traffic originating from the Aspera Shares server, and monitor email queue depth and outbound mail volume for anomalous spikes that could indicate exploitation attempts. Prioritize patching for Aspera Shares instances accessible to untrusted internal users or in multi-tenant environments.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today