Security Bulletin: IBM Aspera Faspex 5.0.4 can be vulnerable to improperly unauthorized password changes

Summary

IBM Aspera Faspex could allow an unauthenticated user to change another user’s credentials. The unauthenticated user can get a token that then lets them change another user’s password. This issue has been resolved.

Vulnerability Details

CVEID:CVE-2023-27875
**DESCRIPTION:**IBM Aspera Faspex 5.0.4 could allow a user to change other user’s credentials due to improper access controls.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/249847 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

The following is impacted by this vulnerability

Remediation/Fixes

Upgrade to the latest container image. Instructions are available at: <https://www.ibm.com/docs/en/aspera-faspex/5.0?topic=upgrades-refreshing-container-images&gt;

Workarounds and Mitigations

None