CVE-2023-27283 IBM Aspera Orchestrator information disclosure

What is CVE-2023-27283?

CVE-2023-27283 is a medium-severity vulnerability in IBM Aspera Orchestrator, published on 4 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.

Weakness: CWE-203, CWE-204

Which versions are affected by CVE-2023-27283?

It affects 1 product.

Products include Ibm Aspera Orchestrator.

How do I fix CVE-2023-27283?

No fix has been published for CVE-2023-27283 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27283 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27283 exists.

Other vulnerabilities in IBM Aspera Orchestrator

• CVE-2025-13481 IBM Aspera Orchestrator Command Injection High 8.8
• CVE-2023-37407 IBM Aspera Orchestrator command execution High 8.8
• CVE-2025-13148 IBM Aspera Orchestrator Unverified Password Change High 8.1
• CVE-2025-13214 IBM Aspera Orchestrator SQL Injection High 7.6
• CVE-2023-38001 IBM Aspera Orchestrator cross-site request forgery Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2m7m-jhx5-8crh.