CVE-2025-13148

CWE-6203 documents3 sources
Severity
6.5MEDIUM
EPSS
0.0%
top 84.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Aspera Orchestrator
Timeline
PublishedDec 11

Description

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDibm/aspera_orchestrator4.0.0 — 4.1.1
▶CVEListV5ibm/aspera_orchestrator4.0.0 — 4.1.0

🔴Vulnerability Details

2
CVEList
IBM Aspera Orchestrator Unverified Password Change↗2025-12-11
▶
GHSA
GHSA-wcv9-7cmw-hf38: IBM Aspera Orchestrator 4↗2025-12-11
▶
CVE-2025-13148 (MEDIUM CVSS 6.5) | IBM Aspera Orchestrator 4.0.0 throu | cvebase.io