CVE-2025-13219mediumCWE-598

CVE-2025-13219: medium-severity vulnerability in IBM Aspera Orchestrator

Multiple vulnerabilities in IBM Aspera Orchestrator

Published · Updated

Follow this CVE+ Monitor Aspera Orchestrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.4%
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
IBM · Aspera Orchestrator
Related CVEs — IBM Aspera Orchestrator

In the same product, most dangerous first.

CVE-2023-37407HIGHIBM Aspera Orchestrator command executionEPSS 0.9%CVE-2025-13481HIGHIBM Aspera Orchestrator Command InjectionEPSS 0.5%CVE-2023-27283MEDIUMIBM Aspera Orchestrator information disclosureEPSS 0.5%CVE-2025-13214HIGHIBM Aspera Orchestrator SQL InjectionEPSS 0.4%CVE-2025-13211MEDIUMIBM Aspera Orchestrator Denial of ServiceEPSS 0.4%CVE-2025-13148HIGHIBM Aspera Orchestrator Unverified Password ChangeEPSS 0.3%