CVE-2025-13214
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Risk Assessment
An attacker could access sensitive data, make unauthorized changes, or delete data, potentially compromising the integrity and confidentiality of information.
Recommendation
Update IBM Aspera Orchestrator to a version containing the fix or apply mitigations such as input validation and limiting database privileges.
Other vulnerabilities in IBM Aspera Orchestrator
See all- CVE-2025-13481High
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation.
- CVE-2025-13211Medium
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency. The flaw affects the email sending mechanism and can be triggered remotely by a logged-in user.
- CVE-2025-13148High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to change the password of another user without prior knowledge of that password.
Original NVD description (English source)
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS