CVE-2020-4434

published 2020-06-10

CVE-2020-4434: Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker…

Priority P3 46 high 7.5 CVSS 3.1

AV N AC H PR L UI N S U C H I H A H

Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900.

Affected

20 ranges

Vendor	Product	Version range	Fixed in
ibm	aspera_application_platform_on_demand	<= 3.7.4	—
ibm	aspera_application_platform_on_demand	—	—
ibm	aspera_faspex_on_demand	<= 3.7.4	—
ibm	aspera_faspex_on_demand	—	—
ibm	aspera_high-speed_transfer_endpoint	<= 3.9.3	—
ibm	aspera_high-speed_transfer_endpoint	—	—
ibm	aspera_high-speed_transfer_server	<= 3.9.3	—
ibm	aspera_high-speed_transfer_server	—	—
ibm	aspera_high-speed_transfer_server_for_cloud_pak_for_integration	<= 3.9.10	—
ibm	aspera_high-speed_transfer_server_for_cloud_pak_for_integration	—	—
ibm	aspera_proxy_server	<= 1.4.3	—
ibm	aspera_proxy_server	—	—
ibm	aspera_server_on_demand	<= 3.7.4	—
ibm	aspera_server_on_demand	—	—
ibm	aspera_shares_on_demand	<= 3.7.4	—
ibm	aspera_shares_on_demand	—	—
ibm	aspera_streaming	<= 3.9.3	—
ibm	aspera_streaming	—	—
ibm	aspera_transfer_cluster_manager	<= 1.3.1	—
ibm	aspera_transfer_cluster_manager	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.0 MEDIUM AV:N/AC:M/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120