Buffer overflow in IBM Aspera Application Platform On Demand
CVE-2020-4435
Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (75.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- IBM Aspera Application Platform On Demand — versions 3.7.4
- IBM Aspera Application Platform On Demand
- IBM Aspera Faspex On Demand — versions 3.7.4
- IBM Aspera Faspex On Demand
- IBM Aspera High-Speed Transfer Endpoint — versions 3.9.3
- IBM Aspera High-Speed Transfer Endpoint
- IBM Aspera High-Speed Transfer Server — versions 3.9.3
- IBM Aspera High-Speed Transfer Server
- IBM Aspera High-Speed Transfer Server For Cloud Pak Integration
- IBM Aspera High-Speed Transfer Server For Cloud Pak Integration (Cp4i) — versions 3.9.10
Weakness classification (CWE)
References
- www.ibm.com/support/pages/node/6221324 (Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/180901 (VDB Entry, vdb-entry, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-4435?
- CVE-2020-4435 is a high-severity vulnerability in IBM Aspera Application Platform On Demand, classified under Out-of-bounds Write. CVSS score: 7.5/10. Published 2020-06-10.
- How severe is CVE-2020-4435?
- High severity. CVSS v3 base score is 7.5 out of 10.