Search criteria
10 vulnerabilities found for Aspera Shares On Demand by IBM
CVE-2020-4436 (GCVE-0-2020-4436)
Vulnerability from nvd – Published: 2020-06-10 12:57 – Updated: 2024-09-16 22:56
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/A:H/C:H/S:U/PR:L/AC:L/UI:N/I:H/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:54.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4436",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4436",
"datePublished": "2020-06-10T12:57:54.614Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:56:39.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4435 (GCVE-0-2020-4435)
Vulnerability from nvd – Published: 2020-06-10 12:57 – Updated: 2024-09-16 22:57
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.676Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:H/AC:H/UI:N/A:H/AV:N/C:H/S:U/PR:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:54.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4435",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4435",
"datePublished": "2020-06-10T12:57:54.172Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:57:12.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4434 (GCVE-0-2020-4434)
Vulnerability from nvd – Published: 2020-06-10 12:57 – Updated: 2024-09-17 00:16
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/I:H/UI:N/A:H/AV:N/C:H/S:U/PR:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:53.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4434",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4434",
"datePublished": "2020-06-10T12:57:53.734Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:16.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4433 (GCVE-0-2020-4433)
Vulnerability from nvd – Published: 2020-06-10 12:57 – Updated: 2024-09-16 23:46
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:49.127Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/I:H/UI:N/PR:L/S:U/C:H/AV:N/A:H/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:53.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4433",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4433",
"datePublished": "2020-06-10T12:57:53.201Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:46:28.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4432 (GCVE-0-2020-4432)
Vulnerability from nvd – Published: 2020-06-10 12:57 – Updated: 2024-09-16 18:29
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.654Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/C:H/A:H/AV:N/PR:L/S:U/I:H/AC:H/UI:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:52.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4432",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4432",
"datePublished": "2020-06-10T12:57:52.760Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:29:54.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4436 (GCVE-0-2020-4436)
Vulnerability from cvelistv5 – Published: 2020-06-10 12:57 – Updated: 2024-09-16 22:56
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/A:H/C:H/S:U/PR:L/AC:L/UI:N/I:H/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:54.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4436",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204436-bo (180902)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180902"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4436",
"datePublished": "2020-06-10T12:57:54.614Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:56:39.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4435 (GCVE-0-2020-4435)
Vulnerability from cvelistv5 – Published: 2020-06-10 12:57 – Updated: 2024-09-16 22:57
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.676Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/I:H/AC:H/UI:N/A:H/AV:N/C:H/S:U/PR:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:54.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4435",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204435-command-exec (180901)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180901"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4435",
"datePublished": "2020-06-10T12:57:54.172Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:57:12.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4434 (GCVE-0-2020-4434)
Vulnerability from cvelistv5 – Published: 2020-06-10 12:57 – Updated: 2024-09-17 00:16
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/I:H/UI:N/A:H/AV:N/C:H/S:U/PR:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:53.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4434",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204434-bo (180900)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180900"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4434",
"datePublished": "2020-06-10T12:57:53.734Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:16:16.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4433 (GCVE-0-2020-4433)
Vulnerability from cvelistv5 – Published: 2020-06-10 12:57 – Updated: 2024-09-16 23:46
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:49.127Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AC:H/I:H/UI:N/PR:L/S:U/C:H/AV:N/A:H/RC:C/RL:O/E:U",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:53.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4433",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204433-bo (180814)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180814"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4433",
"datePublished": "2020-06-10T12:57:53.201Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T23:46:28.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-4432 (GCVE-0-2020-4432)
Vulnerability from cvelistv5 – Published: 2020-06-10 12:57 – Updated: 2024-09-16 18:29
VLAI?
Summary
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.
Severity ?
CWE
- Gain Privileges
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6221324 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Streaming |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Endpoint |
Affected:
3.9.3
|
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) |
Affected:
3.9.10
|
|
| IBM | Aspera Server On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Faspex On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Proxy Server |
Affected:
1.4.3
|
|
| IBM | Aspera Application Platform On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera Shares On Demand |
Affected:
3.7.4
|
|
| IBM | Aspera High-Speed Transfer Server |
Affected:
3.9.3
|
|
| IBM | Aspera Transfer Cluster Manager |
Affected:
1.3.1
|
Date Public ?
2020-06-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:07:48.654Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Aspera Streaming",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Endpoint",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.10"
}
]
},
{
"product": "Aspera Server On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Faspex On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Proxy Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.4.3"
}
]
},
{
"product": "Aspera Application Platform On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera Shares On Demand",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.7.4"
}
]
},
{
"product": "Aspera High-Speed Transfer Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.9.3"
}
]
},
{
"product": "Aspera Transfer Cluster Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
}
],
"datePublic": "2020-06-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/C:H/A:H/AV:N/PR:L/S:U/I:H/AC:H/UI:N/RC:C/E:U/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-10T12:57:52.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2020-06-09T00:00:00",
"ID": "CVE-2020-4432",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Aspera Streaming",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Endpoint",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)",
"version": {
"version_data": [
{
"version_value": "3.9.10"
}
]
}
},
{
"product_name": "Aspera Server On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Faspex On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Proxy Server",
"version": {
"version_data": [
{
"version_value": "1.4.3"
}
]
}
},
{
"product_name": "Aspera Application Platform On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera Shares On Demand",
"version": {
"version_data": [
{
"version_value": "3.7.4"
}
]
}
},
{
"product_name": "Aspera High-Speed Transfer Server",
"version": {
"version_data": [
{
"version_value": "3.9.3"
}
]
}
},
{
"product_name": "Aspera Transfer Cluster Manager",
"version": {
"version_data": [
{
"version_value": "1.3.1"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "H",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6221324",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6221324 (Aspera on Demand (AOD))",
"url": "https://www.ibm.com/support/pages/node/6221324"
},
{
"name": "ibm-aspera-cve20204432-command-exec (180810)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4432",
"datePublished": "2020-06-10T12:57:52.760Z",
"dateReserved": "2019-12-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:29:54.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}