CVE-2023-27874

CRITICAL IN THE WILD

IBM Aspera Faspex 4.4.2 - Authenticated XML External Entity Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-27874 has been observed exploited in the wild (reported by InTheWild.io).

Description

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.

References (2)

Core 2
Core References
Patch, Vendor Advisory vendor-advisory
https://www.ibm.com/support/pages/node/6964694

Scores

CVSS v3 9.9
EPSS 0.0109
EPSS Percentile 78.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

InTheWild.io 2023-04-05
CWE
CWE-611
Status published
Products (2)
ibm/aspera_faspex 4.4.2 patch_level_1 (2 CPE variants)
ibm/aspera_faspex < 4.4.2
Published Mar 21, 2023
Tracked Since Feb 18, 2026