{"api_version":"1","generated_at":"2026-04-22T16:07:33+00:00","cve":"CVE-2025-66485","urls":{"html":"https://cve.report/CVE-2025-66485","api":"https://cve.report/api/cve/CVE-2025-66485.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-66485","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-66485"},"summary":{"title":"Multiple vulnerabilities have been addressed in IBM Aspera Shares","description":"IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-04-01 23:17:02","updated_at":"2026-04-03 19:56:11"},"problem_types":["CWE-644","CWE-644 CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Primary","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7267848","name":"https://www.ibm.com/support/pages/node/7267848","refsource":"psirt@us.ibm.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66485","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66485","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Aspera Shares","version":"affected 1.9.9 1.11.0 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Product(s)Fixing VRMPlatformLink to FixIBM Aspera Shares1.11.1\n\nWindows click here https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Aspera Shares1.11.1\n\nLinux click here https://www.ibm.com/support/fixcentral/swg/selectFixes","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"66485","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"aspera_shares","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"66485","cve":"CVE-2025-66485","epss":"0.000290000","percentile":"0.080890000","score_date":"2026-04-07","updated_at":"2026-04-08 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-66485","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-02T18:10:16.428652Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-04-02T18:10:25.437Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:aspera_shares:1.9.9:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_shares:1.11.0:*:*:*:*:*:*:*"],"product":"Aspera Shares","vendor":"IBM","versions":[{"lessThanOrEqual":"1.11.0","status":"affected","version":"1.9.9","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

"}],"value":"IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-644","description":"CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-01T23:01:47.211Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7267848"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"


Product(s)Fixing VRMPlatformLink to Fix
IBM Aspera Shares
1.11.1
Windowsclick here
IBM Aspera Shares
1.11.1
Linuxclick here
"}],"value":"Product(s)Fixing VRMPlatformLink to FixIBM Aspera Shares1.11.1\n\nWindows click here https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Aspera Shares1.11.1\n\nLinux click here https://www.ibm.com/support/fixcentral/swg/selectFixes"}],"title":"Multiple vulnerabilities have been addressed in IBM Aspera Shares","x_generator":{"engine":"ibm-cvegen"}}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2025-66485","datePublished":"2026-04-01T23:01:47.211Z","dateReserved":"2025-12-02T18:42:37.817Z","dateUpdated":"2026-04-02T18:10:25.437Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-01 23:17:02","lastModifiedDate":"2026-04-03 19:56:11","problem_types":["CWE-644","CWE-644 CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:aspera_shares:*:*:*:*:*:*:*:*","versionStartIncluding":"1.9.9","versionEndExcluding":"1.11.1","matchCriteriaId":"E91033A7-CCAD-49AB-814E-73898AC951E9"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"66485","Ordinal":"1","Title":"Multiple vulnerabilities have been addressed in IBM Aspera Share","CVE":"CVE-2025-66485","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"66485","Ordinal":"1","NoteData":"IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.","Type":"Description","Title":"Multiple vulnerabilities have been addressed in IBM Aspera Share"}]}}}