CVE-2025-36229
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 allow authenticated users to enumerate package identifiers, leading to disclosure of sensitive data information. The vulnerability enables information leakage through identifier guessing.
Risk Assessment
An authenticated user can obtain information about the structure and content of other users' data, potentially facilitating further attacks. Risk of data confidentiality breach within the organization.
Recommendation
Update IBM Aspera Faspex 5 to a version later than 5.0.14.1 if available, or implement controls to restrict access to package identifiers. Monitor authenticated user activity for unusual enumeration patterns.
Other vulnerabilities in IBM Aspera Faspex 5
See all- CVE-2026-14959Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
- CVE-2026-14958Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.
- CVE-2022-47986CriticalActively exploited
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
- CVE-2026-14996High
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
- CVE-2025-36230Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2025-36228Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 may have inconsistent permissions between the user interface and backend API, allowing users to access features that appeared disabled. This could lead to misuse.
- CVE-2025-36171Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
Original NVD description (English source)
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS