CVE-2023-30995: IBM Aspera Faspex improper access control
Published Sep 8, 2023
·Updated
IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. IBM X-Force ID: 254268.
Affected Software
4 affected components
IBM Aspera Faspex<=4.0 - 4.4.2 PL3
IBM Aspera Faspex<=5.0 - 5.0.5
IBM Aspera Faspex<=5.0.5
Linux Linux Kernel
Remediation
Patch Available
Event History
Sep 8, 2023
CVE Published
via MITRE·08:56 PM
Data Sourced
via MITRE·08:56 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2023-30995?
CVE-2023-30995 is a vulnerability in IBM Aspera Faspex 5.0.5 and prior versions that allows a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request.
2
How does CVE-2023-30995 affect IBM Aspera Faspex?
CVE-2023-30995 affects IBM Aspera Faspex versions 5.0.5 and prior.
3
What is the severity of CVE-2023-30995?
CVE-2023-30995 has a severity rating of 7.5 (high).
4
Is Linux Linux Kernel affected by CVE-2023-30995?
No, Linux Linux Kernel is not affected by CVE-2023-30995.
5
How can I fix CVE-2023-30995?
To fix CVE-2023-30995, upgrade to a version of IBM Aspera Faspex that is later than 5.0.5.