{"api_version":"1","generated_at":"2026-11-09T15:51:07+00:00","cve":"CVE-2026-120113","urls":{"html":"https://cve.report/CVE-2026-120113","api":"https://cve.report/api/cve/CVE-2026-120113.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120113","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120113"},"summary":{"title":"Multiple vulnerabilities in IBM Aspera Connect","description":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-11-08 18:17:00","updated_at":"2026-11-08 18:17:00"},"problem_types":["CWE-306","CWE-306 CWE-306 Missing Authentication for Critical Functionality"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Primary","score":"6.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295714","name":"https://www.ibm.com/support/pages/node/7295714","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120113","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120113","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Aspera Connect","version":"affected 1.6.1 4.2.19 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:aspera_connect:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_connect:4.2.19:*:*:*:*:*:*:*"],"product":"Aspera Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.

"}],"value":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing Authentication for Critical Functionality","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-08T17:12:01.863Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295714"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

It is recommended to apply the fix as soon as possible, see links in the table below.

ProductFixing VRMPlatformLink to Fix
IBM Aspera Connect
4.2.20
LinuxLink
IBM Aspera Connect
4.2.20
Mac OSXLink
IBM Aspera Connect
4.2.20
WindowsLink

"}],"value":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes"}],"title":"Multiple vulnerabilities in IBM Aspera Connect"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-120113","datePublished":"2026-11-08T17:12:01.863Z","dateReserved":"2026-10-30T20:49:28.693Z","dateUpdated":"2026-11-08T17:12:01.863Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-08 18:17:00","lastModifiedDate":"2026-11-08 18:17:00","problem_types":["CWE-306","CWE-306 CWE-306 Missing Authentication for Critical Functionality"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120113","Ordinal":"1","Title":"Multiple vulnerabilities in IBM Aspera Connect","CVE":"CVE-2026-120113","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120113","Ordinal":"1","NoteData":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration.","Type":"Description","Title":"Multiple vulnerabilities in IBM Aspera Connect"}]}}}