CVE-2025-13148
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to change the password of another user without prior knowledge of that password.
Risk Assessment
The risk includes unauthorized access to other users' accounts, which could lead to data confidentiality and integrity breaches and privilege escalation.
Recommendation
It is recommended to restrict user permissions, monitor password change activities, and apply patches from IBM.
Other vulnerabilities in IBM Aspera Orchestrator
See all- CVE-2025-13481High
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation.
- CVE-2025-13214High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2025-13211Medium
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency. The flaw affects the email sending mechanism and can be triggered remotely by a logged-in user.
Original NVD description (English source)
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS