CVE-2023-27875 IBM Aspera Faspex improper access controls

High 7.5 Published 16 Mar 2023 Updated 26 Feb 2025

An attacker can change other users' credentials due to improper access controls, leading to account takeover and privilege escalation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-27875?

CVE-2023-27875 is a high-severity missing authorization vulnerability in IBM Aspera Faspex, published on 16 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.

Weakness: CWE-284

Which versions are affected by CVE-2023-27875?

It affects 1 product.

Products include Ibm Aspera Faspex.

How do I fix CVE-2023-27875?

No fix has been published for CVE-2023-27875 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-27875 being exploited?

There is no known exploitation of CVE-2023-27875 in the wild and no public exploit code.

Sources

Also known as GHSA-wf5x-pg8m-g5v4.