Improper access control in IBM Aspera Faspex for Linux and IBM Aspera Faspex for Windows - CVE-2022-22497
Published: May 26, 2022
Vulnerability identifier: #VU63708
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22497
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to an incorrectly computed security token. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Affected software
IBM Aspera Faspex for Linux
IBM Aspera Faspex for Windows
IBM Aspera Faspex for Windows
How to mitigate CVE-2022-22497
Install updates from vendor's website.
IBM Aspera Faspex for Linux - addressed in versions 4.4.1 PL12, 5.0.1
IBM Aspera Faspex for Windows - update to 4.4.1 PL12
IBM Aspera Faspex for Windows - update to 4.4.1 PL12