CVE-2025-13219

CWE-5983 documents3 sources
Severity
7.5HIGH
EPSS
0.0%
top 87.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Aspera Orchestrator
Timeline
PublishedMar 10

Description

IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶NVDibm/aspera_orchestrator3.0.0 — 4.1.3
▶CVEListV5ibm/aspera_orchestrator3.0.0 — 4.1.2

🔴Vulnerability Details

2
GHSA
GHSA-4hf4-8437-8wg9: IBM Aspera Orchestrator 3↗2026-03-10
▶
CVEList
Multiple vulnerabilities in IBM Aspera Orchestrator↗2026-03-10
▶
CVE-2025-13219 (HIGH CVSS 7.5) | IBM Aspera Orchestrator 3.0.0 throu | cvebase.io