IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints.
IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- IBM
- Product
- Aspera Connect
- CVSS v3.1
- 6.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- Weakness
- CWE-862
- Exposure class
- File transfer, Web platform
- NVD status
- Awaiting Analysis
Why it ranks 30 (Notable)
- CVSS v3.1 6.3 medium
- Exposed product class: file transfer
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.