CVE-2020-4432
Quick assessment
Affected
IBM Aspera Streaming
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM Aspera是美国IBM公司的一套基于IBM FASP协议构建的快速文件传输和流解决方案。 多款IBM产品中存在注入漏洞。攻击者可利用该漏洞在SOAP API中执行命令。以下产品及版本受到影响：IBM Aspera High-Speed Transfer Server 3.9.3及之前版本；High-Speed Transfer Endpoint 3.9.3及之前版本；Proxy Server 1.4.3及之前版本；Transfer Cluster Manager 1.3.1版本和3.9.3及之前
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-4432
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
多款IBM产品注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM Aspera是美国IBM公司的一套基于IBM FASP协议构建的快速文件传输和流解决方案。 多款IBM产品中存在注入漏洞。攻击者可利用该漏洞在SOAP API中执行命令。以下产品及版本受到影响：IBM Aspera High-Speed Transfer Server 3.9.3及之前版本；High-Speed Transfer Endpoint 3.9.3及之前版本；Proxy Server 1.4.3及之前版本；Transfer Cluster Manager 1.3.1版本和3.9.3及之前
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Aspera Streaming | 3.9.3 | - |
|
| IBM | Aspera High-Speed Transfer Endpoint | 3.9.3 | - |
|
| IBM | Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) | 3.9.10 | - |
|
| IBM | Aspera Server On Demand | 3.7.4 | - |
|
| IBM | Aspera Faspex On Demand | 3.7.4 | - |
|
| IBM | Aspera Proxy Server | 1.4.3 | - |
|
| IBM | Aspera Application Platform On Demand | 3.7.4 | - |
|
| IBM | Aspera Shares On Demand | 3.7.4 | - |
|
| IBM | Aspera High-Speed Transfer Server | 3.9.3 | - |
|
| IBM | Aspera Transfer Cluster Manager | 1.3.1 | - |
|
II. Public POCs for CVE-2020-4432
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-4432
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-4432 (2)
-
https://www.ibm.com/support/pages/node/6221324 x_refsource_CONFIRM
-
Same Patch Batch · IBM · 2020-06-10 · 6 CVEs total
| CVE-2019-4576 | IBM QRadar Network Packet Capture 安全漏洞 | |
| CVE-2020-4433 | 多款IBM产品缓冲区错误漏洞 | |
| CVE-2020-4434 | 多款IBM产品缓冲区错误漏洞 | |
| CVE-2020-4435 | IBM Aspera 缓冲区错误漏洞 | |
| CVE-2020-4436 | 多款IBM产品缓冲区错误漏洞 |
IV. Related Vulnerabilities
Same vendor: IBM
V. Comments for CVE-2020-4432
No comments yet