CVE-2022-22391 Information disclosure in Aspera High-Speed Transfer Endpoint

Medium 4.3 Published 14 Apr 2022 Updated 16 Sep 2024

An authenticated user can read non-sensitive operating system files they should not have access to in IBM Aspera High-Speed Transfer.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-22391?

CVE-2022-22391 is a medium-severity vulnerability in IBM Aspera High-Speed Transfer Endpoint, published on 14 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059.

Which versions are affected by CVE-2022-22391?

It affects 2 products.

Products include Ibm Aspera High-Speed Transfer Endpoint, Ibm Aspera High-Speed Transfer Server.

How do I fix CVE-2022-22391?

No fix has been published for CVE-2022-22391 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-22391 being exploited?

There is no known exploitation of CVE-2022-22391 in the wild and no public exploit code.

Sources

Also known as GHSA-42fg-q2m2-v999.