Aspera Shares EUVD-2025-209180

CVSS 5.5 with PR:H (authenticated, high-privilege required) indicates moderate risk with a critical constraint: only administrative or power-user accounts can inject payloads. EPSS exploitation probability is not provided in the input, limiting quantification of real-world likelihood. No KEV status, public POC, or active exploitation reported; this is a confirmed vulnerability with vendor patch available, but not a high-urgency zero-day. The risk is primarily internal-insider threats or compromised privileged accounts-rather than external reconnaissance vectors. Organizations with strict role-based access control (RBAC) limiting high-privilege accounts, or with authentication/endpoint monitoring on administrative users, face reduced real-world impact. Contrast with unauthenticated XSS of similar CVSS score: this one requires attacker elevation, reducing mass-exploitation risk. Priority should reflect privilege threshold and user base size of administrative/power users in affected versions.

A disgruntled system administrator with high-privilege credentials injects malicious JavaScript into a file sharing folder name or metadata field via the Aspera Shares Web UI. When other users-including executives or finance staff-access that shared folder, the injected JavaScript executes in their browsers in the context of the trusted Aspera domain, silently capturing session cookies or redirecting them to a phishing login page to harvest credentials. The attacker gains lateral access to sensitive shared files or uses the session to escalate further into the organization's infrastructure. No public POC has been disclosed, but the attack requires only standard Web browser functionality and knowledge of the UI's input fields.