| Package | Affected versions | Patched versions |
|---|---|---|
| aspera application platform on demand | ≤ 3.7.4 | |
| aspera faspex on demand | ≤ 3.7.4 | |
| aspera high-speed transfer endpoint | ≤ 3.9.3 | |
| aspera high-speed transfer server | ≤ 3.9.3 | |
| aspera high-speed transfer server for cloud pak for integration | ≤ 3.9.10 | |
| aspera proxy server | ≤ 1.4.3 | |
| aspera server on demand | ≤ 3.7.4 | |
| aspera shares on demand | ≤ 3.7.4 | |
| aspera streaming | ≤ 3.9.3 | |
| aspera transfer cluster manager | ≤ 1.3.1 |
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free