Detections
Analytics
IBM Aspera Connect 1.6.1 < 4.2.20 Multiple Vulnerabilities (7295714)
medium Nessus Plugin ID 379625
Synopsis
The remote host has an application installed that is affected by multiple vulnerabilities.Description
The version of IBM Aspera Connect installed on the remote host is 1.6.1 through 4.2.19. It is, therefore, affected by multiple vulnerabilities as referenced in the 7295714 advisory.- IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration. (CVE-2026-120113)
- IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations. (CVE-2026-120115)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to IBM Aspera Connect version 4.2.20 or later.See Also
Plugin Details
Severity: Medium
ID: 379625
File Name: ibm_aspera_connect_7295714.nasl
Version: 1.1
Type: Local
Agent: unix
Family: Misc.
Published: 11/12/2026
Updated: 11/12/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-120115
CVSS v3
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Score Source: CVE-2026-120113
Vulnerability Information
CPE: cpe:/a:ibm:aspera_connect
Required KB Items: installed_sw/IBM Aspera Connect
Patch Publication Date: 11/2/2026
Vulnerability Publication Date: 11/5/2026