CVE-2021-38927 IBM Aspera Console cross-site scripting

What is CVE-2021-38927?

CVE-2021-38927 is a high-severity cross-site scripting vulnerability in IBM Aspera Console, published on 25 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.

Weakness: CWE-79

Which versions are affected by CVE-2021-38927?

It affects 1 product.

Products include Ibm Aspera Console.

How do I fix CVE-2021-38927?

No fix has been published for CVE-2021-38927 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-38927 being exploited?

There is no known exploitation of CVE-2021-38927 in the wild and no public exploit code.

Other vulnerabilities in IBM Aspera Console

• CVE-2025-13379 A SQL Injection vulnerability has been addressed in IBM Aspera Console High 8.6
• CVE-2022-43842 IBM Aspera Console SQL injection High 8.6
• CVE-2021-38963 IBM Aspera Console CSV injection High 8.0
• CVE-2022-43851 IBM Aspera Console information disclosure Medium 5.9
• CVE-2022-43847 IBM Aspera Console HTTP header injection Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jfmg-667v-4gmf.