9.8

CVE-2022-47986

Warning

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Data is provided by the National Vulnerability Database (NVD)
Ibm ≫ Aspera Faspex Version <= 4.4.1
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
Ibm ≫ Aspera Faspex Version4.4.2 Update-
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-
Ibm ≫ Aspera Faspex Version4.4.2 Updatepatch_level_1
   Linux ≫ Linux Kernel Version-
   Microsoft ≫ Windows Version-

21.02.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

IBM Aspera Faspex Code Execution Vulnerability

Vulnerability

IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.35% 0.999
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
psirt@us.ibm.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.