CVE-2025-13481
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to execute arbitrary commands with elevated privileges due to improper input validation.
Risk Assessment
Risk of system compromise by an authenticated user, potentially leading to data integrity and confidentiality breaches.
Recommendation
Upgrade to a patched version and restrict user privileges.
Other vulnerabilities in IBM Aspera Orchestrator
See all- CVE-2025-13214High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
- CVE-2025-13211Medium
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency. The flaw affects the email sending mechanism and can be triggered remotely by a logged-in user.
- CVE-2025-13148High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to change the password of another user without prior knowledge of that password.
Original NVD description (English source)
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS