CVE-2025-13211
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency. The flaw affects the email sending mechanism and can be triggered remotely by a logged-in user.
Risk Assessment
An attacker with a valid account can disrupt the email service in Aspera Orchestrator, potentially affecting notifications and mail-dependent workflows. This results in unavailability of email functionality for the organization.
Recommendation
Update IBM Aspera Orchestrator to a patched version or apply vendor-recommended mitigations. Consider restricting accounts that can use the email service and monitoring for unusual activity.
Other vulnerabilities in IBM Aspera Orchestrator
See all- CVE-2025-13481High
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation.
- CVE-2025-13214High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2025-13148High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to change the password of another user without prior knowledge of that password.
Original NVD description (English source)
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS