Aspera Orchestrator
Monthly
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to conduct various attacks against the vulnerable system, including cross-site scri (CVSS 5.4).
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to information disclosure if unauthorized parties have access to the URLs via serve (CVSS 5.9).
Authenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the application then executes with elevated privileges, giving a low-privileged account full control over the host (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the CVSS vector carries PR:L, exploitation requires a valid login on the Orchestrator instance; the attacker does not need victim interaction and can reach the vulnerable component over the network, making this primarily a post-compromise or credentialed-insider escalation path rather than a mass internet-exploitation candidate. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile), so immediate broad scanning activity is not indicated, but the impact once credentials are in hand is complete compromise of confidentiality, integrity, and availability.
SQL injection in IBM Aspera Orchestrator 4.0.0 through 4.1.0 lets an authenticated attacker with low privileges send crafted SQL statements to view, add, modify, or delete data in the back-end database. The CVSS v3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning remote exploitation is possible after authentication but not by fully anonymous internet users. No public exploit has been identified at time of analysis, and EPSS is 0.36% (28th percentile), making this a credible but not emergency-level priority.
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to degrade or exhaust the product's email service by repeatedly triggering email-generating operations faster than the service can process them, because the application does not properly control interaction frequency (CWE-799). The defect is availability-only - there is no data disclosure or modification - and exploitation requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), so remote unauthenticated attackers cannot trigger it. EPSS places it at roughly 0.36% (27th percentile) and no public exploit code has been identified; this is a moderate-severity issue that should be prioritized behind higher-impact findings.
IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows an authenticated remote user to change another user's password without knowing the original password, leading to potential account takeover and integrity compromise. The flaw (CWE-620, Unverified Password Change) requires a valid low-privilege account but no user interaction; it is network-reachable with no special configuration. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.28%, though risk increases in environments with many provisioned users, shared accounts, or exposed self-service portals.
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to conduct various attacks against the vulnerable system, including cross-site scri (CVSS 5.4).
Aspera Orchestrator versions up to 4.1.2 contains a vulnerability that allows attackers to information disclosure if unauthorized parties have access to the URLs via serve (CVSS 5.9).
Authenticated users of IBM Aspera Orchestrator 4.0.0 through 4.1.0 can inject operating-system commands that the application then executes with elevated privileges, giving a low-privileged account full control over the host (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the CVSS vector carries PR:L, exploitation requires a valid login on the Orchestrator instance; the attacker does not need victim interaction and can reach the vulnerable component over the network, making this primarily a post-compromise or credentialed-insider escalation path rather than a mass internet-exploitation candidate. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile), so immediate broad scanning activity is not indicated, but the impact once credentials are in hand is complete compromise of confidentiality, integrity, and availability.
SQL injection in IBM Aspera Orchestrator 4.0.0 through 4.1.0 lets an authenticated attacker with low privileges send crafted SQL statements to view, add, modify, or delete data in the back-end database. The CVSS v3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning remote exploitation is possible after authentication but not by fully anonymous internet users. No public exploit has been identified at time of analysis, and EPSS is 0.36% (28th percentile), making this a credible but not emergency-level priority.
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to degrade or exhaust the product's email service by repeatedly triggering email-generating operations faster than the service can process them, because the application does not properly control interaction frequency (CWE-799). The defect is availability-only - there is no data disclosure or modification - and exploitation requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), so remote unauthenticated attackers cannot trigger it. EPSS places it at roughly 0.36% (27th percentile) and no public exploit code has been identified; this is a moderate-severity issue that should be prioritized behind higher-impact findings.
IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows an authenticated remote user to change another user's password without knowing the original password, leading to potential account takeover and integrity compromise. The flaw (CWE-620, Unverified Password Change) requires a valid low-privilege account but no user interaction; it is network-reachable with no special configuration. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.28%, though risk increases in environments with many provisioned users, shared accounts, or exposed self-service portals.