CVE-2022-43840: IBM Aspera Console XPath injection
Published Apr 14, 2025
·Updated
IBM Aspera Console 3.4.0 through 3.4.4
is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
Affected Software
2 affected components
IBM Aspera Console>=3.4.0<=3.4.4
IBM Aspera Console>=3.4.0<=3.4.4
Remediation
Information
It is recommended that customers upgrade to the latest version of IBM Aspera Console:
Product(s)Fixing VRMPlatformLink to FixIBM Aspera Console3.4.5
Windows click here https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Console3.4.5
Linux click here https://www.ibm.com/support/fixcentral/swg/downloadFixes
Event History
Apr 14, 2025
CVE Published
via MITRE·08:43 PM
Data Sourced
via MITRE·08:43 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-43840?
CVE-2022-43840 has a medium severity rating due to its potential to allow an authenticated attacker to exfiltrate sensitive data.
2
How do I fix CVE-2022-43840?
To fix CVE-2022-43840, upgrade IBM Aspera Console to version 3.4.5 or later.
3
Who is affected by CVE-2022-43840?
CVE-2022-43840 affects versions 3.4.0 to 3.4.4 of IBM Aspera Console.
4
What types of data can be compromised by CVE-2022-43840?
CVE-2022-43840 can lead to the exfiltration of sensitive application data and the disclosure of the XML document structure.
5
Is authentication required to exploit CVE-2022-43840?
Yes, CVE-2022-43840 requires an authenticated attacker to exploit the XPath injection vulnerability.