{"id":"CVE-2020-4432","state":"PUBLISHED","title":"Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute comma","description":"Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.","publishedAt":"2020-06-10T12:57:52.760Z","updatedAt":"2024-09-16T18:29:54.370Z","severity":{"score":7.5,"label":"High","version":"3.0","vector":"CVSS:3.0/C:H/A:H/AV:N/PR:L/S:U/I:H/AC:H/UI:N/RC:C/E:U/RL:O","source":"ibm"},"assigner":"ibm","products":["IBM Aspera Streaming","IBM Aspera High-Speed Transfer Endpoint","IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)","IBM Aspera Server On Demand","IBM Aspera Faspex On Demand","IBM Aspera Proxy Server","IBM Aspera Application Platform On Demand","IBM Aspera Shares On Demand","IBM Aspera High-Speed Transfer Server","IBM Aspera Transfer Cluster Manager"],"affected":[{"vendor":"IBM","product":"Aspera Streaming","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Endpoint","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)","versions":[{"version":"3.9.10","status":"affected"}]},{"vendor":"IBM","product":"Aspera Server On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Faspex On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Proxy Server","versions":[{"version":"1.4.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera Application Platform On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Shares On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Server","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera Transfer Cluster Manager","versions":[{"version":"1.3.1","status":"affected"}]}],"references":["https://www.ibm.com/support/pages/node/6221324","https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"],"weaknesses":[],"ingestedAt":"2026-10-29T19:47:32.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/4xxx/CVE-2020-4432.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-4432","state":"PUBLISHED","datePublished":"2020-06-10T12:57:52.760Z","dateUpdated":"2024-09-16T18:29:54.370Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2019-12-30T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."}],"affected":[{"vendor":"IBM","product":"Aspera Streaming","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Endpoint","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)","versions":[{"version":"3.9.10","status":"affected"}]},{"vendor":"IBM","product":"Aspera Server On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Faspex On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Proxy Server","versions":[{"version":"1.4.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera Application Platform On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera Shares On Demand","versions":[{"version":"3.7.4","status":"affected"}]},{"vendor":"IBM","product":"Aspera High-Speed Transfer Server","versions":[{"version":"3.9.3","status":"affected"}]},{"vendor":"IBM","product":"Aspera Transfer Cluster Manager","versions":[{"version":"1.3.1","status":"affected"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/6221324","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/180810","name":"ibm-aspera-cve20204432-command-exec (180810)","tags":["vdb-entry","x_refsource_XF"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","exploitCodeMaturity":"UNPROVEN","integrityImpact":"HIGH","privilegesRequired":"LOW","remediationLevel":"OFFICIAL_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":6.5,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.0/C:H/A:H/AV:N/PR:L/S:U/I:H/AC:H/UI:N/RC:C/E:U/RL:O","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Gain Privileges","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2020-06-10T12:57:52.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2020-06-09T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2020-06-09T00:00:00","ID":"CVE-2020-4432","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Aspera Streaming","version":{"version_data":[{"version_value":"3.9.3"}]}},{"product_name":"Aspera High-Speed Transfer Endpoint","version":{"version_data":[{"version_value":"3.9.3"}]}},{"product_name":"Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)","version":{"version_data":[{"version_value":"3.9.10"}]}},{"product_name":"Aspera Server On Demand","version":{"version_data":[{"version_value":"3.7.4"}]}},{"product_name":"Aspera Faspex On Demand","version":{"version_data":[{"version_value":"3.7.4"}]}},{"product_name":"Aspera Proxy Server","version":{"version_data":[{"version_value":"1.4.3"}]}},{"product_name":"Aspera Application Platform On Demand","version":{"version_data":[{"version_value":"3.7.4"}]}},{"product_name":"Aspera Shares On Demand","version":{"version_data":[{"version_value":"3.7.4"}]}},{"product_name":"Aspera High-Speed Transfer Server","version":{"version_data":[{"version_value":"3.9.3"}]}},{"product_name":"Aspera Transfer Cluster Manager","version":{"version_data":[{"version_value":"1.3.1"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810."}]},"impact":{"cvssv3":{"BM":{"A":"H","AC":"H","AV":"N","C":"H","I":"H","PR":"L","S":"U","UI":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Gain Privileges"}]}]},"references":{"reference_data":[{"name":"https://www.ibm.com/support/pages/node/6221324","refsource":"CONFIRM","title":"IBM Security Bulletin 6221324 (Aspera on Demand (AOD))","url":"https://www.ibm.com/support/pages/node/6221324"},{"name":"ibm-aspera-cve20204432-command-exec (180810)","refsource":"XF","title":"X-Force Vulnerability Report","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/180810"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/6221324","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/180810","name":"ibm-aspera-cve20204432-command-exec (180810)","tags":["vdb-entry","x_refsource_XF","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T08:07:48.654Z"}}]}}}