Security Bulletin: IBM Aspera Console has addressed multiple cross-site scripting vulnerabilities (CVE-2022-43384, CVE-2022-43575)

Summary

This Security Bulletin addresses security vulnerabilities related to cross-site scripting that have been remediated (CVE-2022-43384, CVE-2022-43575) in IBM Aspera Console 3.4.2 PL6.

Vulnerability Details

CVEID:CVE-2022-43384
**DESCRIPTION:**IBM Aspera Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 4.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238645 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

CVEID:CVE-2022-43575
**DESCRIPTION:**IBM Aspera Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238680 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

It is recommended that customers upgrade to the latest version of IBM Aspera Console:

3.4.2 PL 10

| Windows| click here
IBM Aspera Console|

3.4.2 PL 10

| Linux| click here

Workarounds and Mitigations

None