IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Metrics
Version
Base score
Base severity
Vector
3.1
5.4
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Version:3.1
Base score:5.4
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
IBM strongly recommends addressing the vulnerabilities now by upgrading to Faspex 5.0.15 available from the link below.
ProductFixing VRMPlatformLink to FixIBM Aspera Faspex5.0.15
Linux link https://www.ibm.com/support/fixcentral/swg/downloadFixes