CVE-2022-43845 - IBM Aspera Console information disclosure

Back Back to CVE browser

HIGH

IBM Aspera Console information disclosure

Published Sep 24, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.43%

Description

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

Affected products

Vendor IBM Product Aspera Console Default
unaffected
- Version
  3.4.0
  Status
  affected
  Constraints
  <=3.4.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Aspera Console

unaffected

Version	Status	Constraints
3.4.0	affected	<=3.4.4

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1004

CWE-732

Incorrect Permission Assignment

References (1)

https://www.ibm.com/support/pages/node/7169766
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7169766		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Sep 24, 2024

Updated Sep 24, 2024

Reserved Oct 26, 2022

Link CVE-2022-43845

CISA Vulnrichment

Updated Sep 24, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2022-43845

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-43845