IBM Aspera Faspex XML external entity injection
Priority MEDIUM 46CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01343 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Aspera Faspex | 4.4.2 | — | No fix listed | CNA |
- Aspera Faspex VendorIBM Affected 4.4.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:* | up to 4.4.2 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_faspex:4.4.2:patch_level_1:*:*:*:*:*:* | 4.4.2 patch_level_1 | Vulnerable | IBM |
| cpe:2.3:a:ibm:aspera_faspex:4.4.2:patch_level_2:*:*:*:*:*:* | 4.4.2 patch_level_2 | Vulnerable | IBM |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
- cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:* Versions up to 4.4.2 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_faspex:4.4.2:patch_level_1:*:*:*:*:*:* Versions 4.4.2 patch_level_1 Vulnerable ·IBM
- cpe:2.3:a:ibm:aspera_faspex:4.4.2:patch_level_2:*:*:*:*:*:* Versions 4.4.2 patch_level_2 Vulnerable ·IBM
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
IBM Aspera Faspex — ibm.com/support/pages/node/6964694
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-12468 IBM Aspera Faspex information disclosurePriority MEDIUM 41
- TI-2023-12469 IBM Aspera Faspex information disclosurePriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2023-27874
- 2026-10-03 Alias added: GHSA-g822-3v64-2vpm
References
More IBM Aspera Faspex vulnerabilities
- TI-2022-23774 IBM Aspera Faspex code execution KEVCVSS 3.1CRITICAL 9.8
- TI-2026-12597 OS Command Injection in IBM Aspera Faspex CVSS 3.1CRITICAL 9.1
- TI-2026-12596 OS command injection in IBM Aspera Faspex CVSS 3.1CRITICAL 9.1
- TI-2026-12622 Multiple vulnerabilities in IBM Aspera Faspex CVSS 3.1HIGH 8.2
- TI-2023-19019 IBM Aspera Faspex information disclosure CVSS 3.1CRITICAL 9.8
- TI-2023-17972 IBM Aspera Faspex information disclosure CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-27874 · CVE Program
- CVE-2023-27874 · NVD
- FIRST EPSS
- GHSA-g822-3v64-2vpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences