by Kastro
Paper/Archive/CVE-2023-35907

CVE-2023-35907

IBM Aspera Faspex — IBM Aspera Faspex information disclosure

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 25.7.257 × 205.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

Affected

ProductAffectedFixed inSource
Aspera Faspex5.0.0 – 5.0.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refibm.com/support/pages/node/7181814