CVEvulnerability

CVE-2020-4435

7.5 HIGH Published 2020-06-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-06-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-787

Description

Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacker with intimate knowledge of the system to execute arbitrary code or perform a denial-of-service (DoS) through the http fallback service. IBM X-Force ID: 180901.

Affected configurations

• ibm aspera application platform on demand (<= 3.7.4) • ibm aspera faspex on demand (<= 3.7.4) • ibm aspera high-speed transfer endpoint (<= 3.9.3) • ibm aspera high-speed transfer server (<= 3.9.3) • ibm aspera high-speed transfer server for cloud pak for integration (<= 3.9.10) • ibm aspera proxy server (<= 1.4.3) • ibm aspera server on demand (<= 3.7.4) • ibm aspera shares on demand (<= 3.7.4) • ibm aspera streaming (<= 3.9.3) • ibm aspera transfer cluster manager (<= 1.3.1)

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References