IBM Aspera Faspex 5 Vulnerabilities: CVE-2025-33137/33136/33138 Advisory and Patch

Critical Vulnerability Information Vulnerability Overview IBM Aspera Faspex contains user input sanitization and HTML injection vulnerabilities (CVE-2025-33137, CVE-2025-33136, CVE-2025-33138). Vulnerability Details CVE-2025-33137 - Description: IBM Aspera Faspex 5 may allow authenticated users to obtain sensitive information or perform unauthorized actions on behalf of other users, due to insufficient client-side enforcement of server-side security. - CWE: CWE-602: Client-Side Enforcement of Server-Side Security - CVSS Base Score: 7.1 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) CVE-2025-33136 - Description: IBM Aspera Faspex 5 may allow authenticated users to obtain sensitive information or perform unauthorized actions on behalf of other users, due to inadequate protection of assumed immutable data. - CWE: CWE-471: Modification of Assumed Immutable Data (MAID) - CVSS Base Score: 7.1 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) CVE-2025-33138 - Description: IBM Aspera Faspex 5 is vulnerable to HTML injection. Remote attackers can inject malicious HTML code, which, when viewed in a victim’s web browser, executes within the security context of the hosted site. - CWE: CWE-80: Improper Neutralization of Script-Related HTML Tags in Web Pages (Basic XSS) - CVSS Base Score: 5.4 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:A/N) Affected Products and Versions Remediation IBM strongly recommends resolving these vulnerabilities by upgrading the container image to version 5.0.12.1, which is available from the IBM Container Registry. Workarounds and Mitigations None Release History May 21, 2025: Initial release

Goal Reached Thanks to every supporter — we hit 100%!

IBM Aspera Faspex 5 Vulnerabilities: CVE-2025-33137/33136/33138 Advisory and Patch