6.3
Medium
CVE-2026-120115 Multiple vulnerabilities in IBM Aspera Connect
Description
IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Aspera Connect 1.6 | 1.6.1 → 4.2.19 | No fix stated |
Other CVEs of Aspera Connect
The 5 CVEs of Aspera Connect →
CVE-2026-120113
Multiple vulnerabilities in IBM Aspera Connect
6.4
Medium
CVE-2023-27285
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulnerable to a buffer overflow, caused by improper bounds…
8.4
High
CVE-2023-22862
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method…
5.9
Medium
CVE-2020-4545
IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper…
7.8
High