IBM Aspera Faspex authorization bypass grants full admin rights
Anyone with a login can take over the file transfer server!
Summary
An authorized user can craft a specific message to bypass user authorization checks and gain full administrative privileges. IBM Aspera Faspex 5.0.0 through 5.0.19 are affected.
Affected when
- an authorized user account
What to do
Update to IBM Aspera Faspex 5.0.19 PL1. Check that the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack: 1). No workaround is listed.
Products and platforms
CVE IDs
Sources
- Advisory: ibm.com (opens in a new tab)
- Repository: foxcornlab/faspex-scanner (opens in a new tab)
Times
First published
First seen