Aspera Faspex vulnerabilitiesAnd the versions its exploited flaws hit.
Aspera Faspex is made by IBM. We track 39 published vulnerabilities listed under that exact name, across 12 versions. 1 of them is on the list of flaws known to be exploited, the newest added on 21 February 2023. IBM lists newer releases under their own names, such as Aspera Faspex on Demand, so check those pages too.
The most recent Aspera Faspex flaw added to the known-exploited list is CVE-2022-47986, on 21 February 2023. We keep watching the known-exploited list.
Is Aspera Faspex listed under other names? Yes.
IBM also lists Aspera Faspex under more specific names, such as Aspera Faspex on Demand. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which versions of Aspera Faspex do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2022-47986Exploited list, 21 Feb 2023
IBM Aspera Faspex Code Execution Vulnerability
up to 4.4.14.4.24.4.2-patch_level_1
Which Aspera Faspex vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8IBM Aspera Faspex Code Execution Vulnerability
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Which Aspera Faspex flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw.
- 1.3%CVE-2023-27874High
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data.
- 1.1%CVE-2022-22497High
IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token.
- 0.9%CVE-2023-27871High
IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query.
- 0.8%CVE-2023-27873Medium
IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input.
- 0.8%CVE-2022-22409Medium
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather sensitive information about the web application, caused by an insecure configuration.
- 0.8%CVE-2023-30995High
IBM Aspera Faspex 4.0 through 4.4.2 and 5.0 through 5.0.5 could allow a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request.
- 0.7%CVE-2023-27279Medium
IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a user to cause a denial of service due to missing API rate limiting.
- 0.6%CVE-2023-27875High
IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls.
- 0.5%CVE-2022-22401High
IBM Aspera Faspex 5.0.5 could allow a remote attacker to gather or persuade a naive user to supply sensitive information.
Running Aspera Faspex? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
- Matched to
- Aspera Faspex on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 39 published vulnerabilities listed under the name Aspera Faspex, across 12 versions. The most recent Aspera Faspex flaw added to the known-exploited list is CVE-2022-47986, on 21 February 2023.
1 is on the list of flaws known to be exploited. The most recently added is CVE-2022-47986.
IBM also lists Aspera Faspex under more specific names, such as Aspera Faspex on Demand. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Each flaw names its own versions, usually as ranges. The newest, CVE-2022-47986, affects up to 4.4.1, 4.4.2, 4.4.2-patch_level_1. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Aspera Faspex. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.