CVE-2023-37395: IBM Aspera Faspex information disclosure

Q: What is the severity of CVE-2023-37395?

CVE-2023-37395 has been rated as a moderate severity vulnerability due to the potential for sensitive information disclosure.

Q: How do I fix CVE-2023-37395?

To remediate CVE-2023-37395, it is recommended to upgrade IBM Aspera Faspex to version 5.0.8 or later.

Q: What types of sensitive information could be exposed in CVE-2023-37395?

CVE-2023-37395 could expose sensitive information that is improperly encrypted and accessible to local users.

Q: Who is affected by CVE-2023-37395?

CVE-2023-37395 affects local users on systems running IBM Aspera Faspex versions 5.0.0 to 5.0.7.

Q: Is CVE-2023-37395 a software bug or hardware issue?

CVE-2023-37395 is a software bug related to improper encryption in IBM Aspera Faspex.

Published Apr 18, 2024

Updated

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryption of certain data.

Other sources

IBM Aspera Faspex could allow a local user to obtain sensitive information due to improper encryption of certain data.

— IBM

Affected Software

2 affected components

IBM Aspera Faspex 5<=5.0.0 - 5.0.7

IBM Aspera Faspex>=5.0.0<=5.0.7

Event History

Apr 18, 2024

CVE Published

via IBM·12:00 AM

Dec 11, 2024

CVE Published

via MITRE·02:49 AM

Data Sourced

via MITRE·02:49 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7148632

Frequently Asked Questions

What is the severity of CVE-2023-37395?

CVE-2023-37395 has been rated as a moderate severity vulnerability due to the potential for sensitive information disclosure.

How do I fix CVE-2023-37395?

To remediate CVE-2023-37395, it is recommended to upgrade IBM Aspera Faspex to version 5.0.8 or later.

What types of sensitive information could be exposed in CVE-2023-37395?