CVEvulnerability

CVE-2020-4434

7.5 HIGH Published 2020-06-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-120

Description

Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180900.

Affected configurations

• ibm aspera application platform on demand (<= 3.7.4) • ibm aspera faspex on demand (<= 3.7.4) • ibm aspera high-speed transfer endpoint (<= 3.9.3) • ibm aspera high-speed transfer server (<= 3.9.3) • ibm aspera high-speed transfer server for cloud pak for integration (<= 3.9.10) • ibm aspera proxy server (<= 1.4.3) • ibm aspera server on demand (<= 3.7.4) • ibm aspera shares on demand (<= 3.7.4) • ibm aspera streaming (<= 3.9.3) • ibm aspera transfer cluster manager (<= 1.3.1)

Related

Weakness · CWE (1)

  • CWE-120 Buffer Copy without Checking Size of Input weakness

References