CVE-2023-22862 IBM Aspera information disclosure
IBM Aspera Connect and Cargo transmit authentication credentials insecurely, allowing attackers to intercept and retrieve sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22862?
CVE-2023-22862 is a medium-severity vulnerability in IBM Aspera Cargo, published on 4 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Which versions are affected by CVE-2023-22862?
It affects 2 products.
Products include Ibm Aspera Cargo, Ibm Aspera Connect.
How do I fix CVE-2023-22862?
No fix has been published for CVE-2023-22862 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22862 being exploited?
There is no known exploitation of CVE-2023-22862 in the wild and no public exploit code.
Other vulnerabilities in IBM Aspera Cargo
Sources
Also known as GHSA-fc5m-2qwj-qjh3.