PT-2024-10999 · Ibm · Ibm Aspera Console

Published 2024-09-24 · Updated 2024-09-30 · CVE-2021-38963

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Aspera Console versions 3.4.0 through 3.4.4

Description The issue is caused by a CSV injection vulnerability, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by persuading a victim to open a specially crafted file. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For IBM Aspera Console versions 3.4.0 through 3.4.4, upgrade the affected components immediately to mitigate risks. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-38963

Affected Products

Ibm Aspera Console

References · 7

• https://osv.dev/vulnerability/CVE-2021-38963 · Vendor Advisory
• https://ibm.com/support/pages/node/7169765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38963 · Security Note
• https://twitter.com/CVEnew/status/1838528619775185178 · Twitter Post
• https://twitter.com/oktsec/status/1838558405415367009 · Twitter Post
• https://twitter.com/cracbot/status/1840632715584114696 · Twitter Post
• https://twitter.com/cracbot/status/1839183225429832177 · Twitter Post