CVE-2022-43845lowCWE-1004

CVE-2022-43845: low-severity vulnerability in IBM Aspera Console

IBM Aspera Console information disclosure

Published

Follow this CVE+ Monitor Aspera Console

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.4%
In short

IBM Aspera Console versions 3.4.0 to 3.4.4 have a security setting missing that protects cookies from being accessed by malicious websites. An attacker can steal sensitive information stored in cookies through a web-based attack.

Technical detail

The HTTPOnly flag is not set on cookies in IBM Aspera Console 3.4.0-3.4.4, allowing JavaScript execution in the browser context to access sensitive session cookies. This enables cross-site scripting (XSS) attacks to exfiltrate authentication tokens or session identifiers without requiring direct server compromise.

Summary generated and translated by AI from the official description.
IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
IBM · Aspera Console
Related CVEs — IBM Aspera Console

In the same product, most dangerous first.

CVE-2021-38963HIGHIBM Aspera Console CSV injectionEPSS 0.6%CVE-2022-43842HIGHIBM Aspera Console SQL injectionEPSS 0.5%CVE-2025-13459LOWIBM Aspera Console Denial of ServiceEPSS 0.4%CVE-2025-13379HIGHA SQL Injection vulnerability has been addressed in IBM Aspera ConsoleEPSS 0.4%CVE-2021-38927HIGHIBM Aspera Console cross-site scriptingEPSS 0.3%CVE-2025-13925MEDIUMMultiple vulnerabilities in IBM Aspera ConsoleEPSS 0.3%