{"id":"CVE-2025-36227","state":"PUBLISHED","title":"Multiple vulnerabilities in IBM Aspera Faspex","description":"IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.","publishedAt":"2026-03-10T19:57:16.491Z","updatedAt":"2026-03-10T20:12:39.788Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"ibm"},"assigner":"ibm","products":["IBM Aspera Faspex 5"],"affected":[{"vendor":"IBM","product":"Aspera Faspex 5","versions":[{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.0.14.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:aspera_faspex_5:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_faspex_5:5.0.14.3:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7262816"],"weaknesses":["CWE-644"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/36xxx/CVE-2025-36227.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-36227","state":"PUBLISHED","datePublished":"2026-03-10T19:57:16.491Z","dateUpdated":"2026-03-10T20:12:39.788Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-04-15T21:16:41.802Z"},"containers":{"cna":{"title":"Multiple vulnerabilities in IBM Aspera Faspex","descriptions":[{"lang":"en","value":"IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking."}],"affected":[{"vendor":"IBM","product":"Aspera Faspex 5","versions":[{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.0.14.3","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:aspera_faspex_5:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_faspex_5:5.0.14.3:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7262816","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-644","lang":"en","description":"CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-03-10T19:57:16.491Z"},"solutions":[{"lang":"en","value":"IBM strongly recommends addressing the vulnerabilities now by upgrading to Faspex 5.0.15 available from the link below.\n\n \n\nProductFixing VRMPlatformLink to FixIBM Aspera Faspex5.0.15\n\nLinux link https://www.ibm.com/support/fixcentral/swg/downloadFixes","supportingMedia":[{"type":"text/html","base64":false,"value":"<div>IBM strongly recommends addressing the vulnerabilities now by upgrading to Faspex 5.0.15 available from the link below.</div><p>&nbsp;</p><div><table><tbody><tr><td><strong>Product</strong></td><td><strong>Fixing VRM</strong></td><td><strong>Platform</strong></td><td><strong>Link to Fix</strong></td></tr><tr><td>IBM Aspera Faspex</td><td><div>5.0.15</div></td><td>Linux</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&amp;product=ibm/Other+software/IBM+Aspera+Faspex+Server&amp;release=All&amp;platform=All&amp;function=fixId&amp;fixids=ibm-aspera-faspex-5.0.15.8990.x86_64&amp;includeRequisites=0&amp;includeSupersedes=0&amp;downloadMethod=http&amp;login=true\" rel=\"nofollow\">link</a></td></tr></tbody></table></div>"}]}],"x_generator":{"engine":"ibm-cvegen"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-36227","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-03-10T20:08:32.595239Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-10T20:12:39.788Z"}}]}}}