8.1
CVE-2025-13148
- EPSS 0.03%
- Veröffentlicht 11.12.2025 19:48:18
- Zuletzt bearbeitet 15.12.2025 19:06:52
- Quelle psirt@us.ibm.com
- CVE-Watchlists
- Unerledigt
IBM Aspera Orchestrator Unverified Password Change
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Aspera Orchestrator Version >= 4.0.0 < 4.1.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.03% | 0.076 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
| psirt@us.ibm.com | 8.1 | 2.8 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
CWE-620 Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.