EUVD-2025-208657
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
4Description
IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
Analysis
IBM Aspera Console versions 3.3.0 through 3.4.8 contain an improper rate-limiting vulnerability in the email service that allows authenticated users to trigger a denial of service condition. An attacker with valid credentials can abuse the email functionality by sending requests at excessive frequencies, exhausting service resources and rendering the email feature unavailable to legitimate users. This vulnerability requires authentication and does not provide confidentiality or integrity impact, resulting in a moderate CVSS score of 5.3.
Technical Context
The vulnerability exists in IBM Aspera Console's email service component, which fails to implement adequate rate-limiting or request throttling mechanisms. This falls under CWE-799 (Improper Control of Interaction Frequency), a weakness category that encompasses scenarios where applications do not properly restrict the frequency or volume of interactions from users. The affected software is identified via CPE string cpe:2.3:a:ibm:aspera_console, spanning versions 3.3.0 through 3.4.8. The email service likely uses standard SMTP or internal mail relay mechanisms, but lacks authentication-based quotas or per-user request frequency controls that would prevent abuse by authenticated actors.
Affected Products
IBM Aspera Console versions 3.3.0 through 3.4.8 are affected, as identified by CPE cpe:2.3:a:ibm:aspera_console. Users running any version within this range should prioritize assessment and patching. IBM has released security advisories addressing this vulnerability; consult IBM Security Bulletins or the IBM Aspera product security page for the official advisory and patch availability confirmation.
Remediation
Upgrade IBM Aspera Console to version 3.4.9 or later (specific version availability should be confirmed via IBM's security advisory). Organizations unable to patch immediately should implement compensating controls by restricting network access to the Aspera Console email service to trusted internal networks only, implementing authentication-based rate-limiting at a reverse proxy or WAF level to cap email service requests per authenticated user, and monitoring email service logs for unusual request frequency patterns. Enable multi-factor authentication on all Aspera Console administrative accounts to reduce the risk of compromised credentials being used for abuse.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today