Description
IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Aspera Connect | 1.6.1 – ≤ 4.2.19 | — |
References
- https://www.ibm.com/support/pages/node/7295714 vendor-advisory patch