IBM Aspera Orchestrator Sensitive Information Disclosure Vulnerability

A vulnerability exists in IBM Aspera Orchestrator versions 3.0.0 through 4.1.2, where sensitive information is stored in URL parameters. This issue could lead to unauthorized information disclosure if such URLs are accessed through server logs, the referrer header, or browser history.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information.

Remediation

Users can upgrade to IBM Aspera Orchestrator version 4.1.3 to address this vulnerability. Instructions for downloading this version are available on the IBM Support Fix Central website.