CVE-2023-38018: IBM Aspera Shares session fixation

Q: What is the severity of CVE-2023-38018?

The severity level of CVE-2023-38018 is critical due to the potential for user impersonation.

Q: How do I fix CVE-2023-38018?

To fix CVE-2023-38018, update IBM Aspera Shares to a version that properly invalidates sessions after a password change.

Q: What systems are affected by CVE-2023-38018?

CVE-2023-38018 affects IBM Aspera Shares version 1.10.0 PL2 and earlier.

Q: What does CVE-2023-38018 exploit?

CVE-2023-38018 exploits the failure to invalidate user sessions after password changes.

Q: Who reported CVE-2023-38018?

CVE-2023-38018 was reported by IBM's X-Force team.

Published Aug 8, 2024

Updated

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574.

Other sources

IBM Aspera Shares does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.

— IBM

Affected Software

2 affected components

IBM Aspera Shares<=0.0.0 - 1.10.0 PL2

IBM Aspera Shares=1.10.0-patch_level2

Event History

Aug 8, 2024

CVE Published

via IBM·12:00 AM

Aug 9, 2024

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionSeverityWeakness

Aug 12, 2024

Data Sourced

via NVD·01:38 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7164325

Frequently Asked Questions

What is the severity of CVE-2023-38018?

The severity level of CVE-2023-38018 is critical due to the potential for user impersonation.

How do I fix CVE-2023-38018?

To fix CVE-2023-38018, update IBM Aspera Shares to a version that properly invalidates sessions after a password change.

What systems are affected by CVE-2023-38018?