IBM Aspera Faspex Improper Data Protection Vulnerability Allowing Unauthorized Actions or Information Disclosure

A vulnerability exists in IBM Aspera Faspex versions 5.0.0 to 5.0.12, allowing authenticated users to access sensitive information or execute unauthorized actions on behalf of other users. This issue arises from inadequate protection of data assumed to be immutable, leading to potential misuse of user privileges.

Impact

Exploitation of this vulnerability could result in unauthorized actions being performed on behalf of another user or sensitive information being disclosed to an authenticated user.

Remediation

Users are advised to upgrade to version 5.0.12.1, available from the IBM Container Registry. Instructions for upgrading can be found in the IBM Aspera Faspex documentation.