IBM Aspera Shares XML External Entity Injection Vulnerability

A vulnerability allowing XML external entity injection (XXE) has been identified in IBM Aspera Shares versions 1.9.9 through 1.10.0 PL7. This vulnerability arises when the application processes XML data, creating an opportunity for remote authenticated attackers to exploit it. The exploitation of this vulnerability could lead to the exposure of sensitive information or the consumption of memory resources.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information or excessive memory usage, potentially leading to a denial-of-service condition.

Remediation

Users are advised to upgrade to IBM Aspera Shares version 1.10.0 PL8. Instructions for downloading this version are available on the IBM Support Fix Central website.