CVE-2025-13459

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13459", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-11-19T20:57:57.020Z", "datePublished": "2026-03-13T19:54:05.962Z", "dateUpdated": "2026-03-16T13:51:49.820Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:54:05.962Z"}, "title": "IBM Aspera Console Denial of Service", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-841", "description": "CWE-841 Improper Enforcement of Behavioral Workflow", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Aspera Console", "versions": [{"status": "affected", "version": "3.3.0", "lessThanOrEqual": "3.4.8", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263486", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"}}], "solutions": [{"lang": "en", "value": "Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T13:51:34.449439Z", "id": "CVE-2025-13459", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:51:49.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13459", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:51:34.449439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:51:46.260Z"}}], "cna": {"title": "IBM Aspera Console Denial of Service", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Aspera Console", "versions": [{"status": "affected", "version": "3.3.0", "versionType": "semver", "lessThanOrEqual": "3.4.8"}]}], "solutions": [{"lang": "en", "value": "Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link", "supportingMedia": [{"type": "text/html", "value": "<p>Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263486", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841 Improper Enforcement of Behavioral Workflow"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:54:05.962Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13459", "state": "PUBLISHED", "dateUpdated": "2026-03-16T13:51:49.820Z", "dateReserved": "2025-11-19T20:57:57.020Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-13T19:54:05.962Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"], "product": "Aspera Console", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.4.8", "status": "affected", "version": "3.3.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "51419171-DDAE-4AA6-9109-0582F2133296", "versionEndExcluding": "3.4.9", "versionStartIncluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow."}, {"lang": "es", "value": "IBM Aspera Console 3.3.0 hasta 3.4.8 podr\u00eda permitir a un usuario privilegiado causar una denegaci\u00f3n de servicio debido a una aplicaci\u00f3n indebida del flujo de trabajo de comportamiento."}], "id": "CVE-2025-13459", "lastModified": "2026-06-17T08:34:11.230", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13459", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T13:51:34.449439Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:54.710", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7263486"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-841"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.4.8]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Aspera Console", "source": "cna", "vendor": "IBM"}, "product": "aspera_console", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-03-17T17:32:10.064916+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s remediation by upgrading IBM Aspera Console to version 3.4.9 or later, as recommended in the CNA solution."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected products include IBM Aspera Console for Windows and Linux platforms. All releases from 3.3.0 up to and including 3.4.8 are impacted, encompassing both the 3.3.x and 3.4.x series. No other vendor products are listed in the CNA data, and the CPE entries confirm the scope is limited to the Aspera Console application itself.", "description_and_impact": "IBM Aspera Console versions 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow, as detailed by the vendor\u2019s description. This flaw permits the attacker to interrupt normal operation of the console, thereby compromising availability for users interacting with the service. The weakness is associated with CWE-841, indicating a defect in how system behavior is enforced or logged. The impact is localized to systems running the affected console and does not directly expose data or allow remote code execution.", "risk_and_exploitability": "The CVSS score of 2.7 places this vulnerability in the low severity range, and the EPSS score indicates a probability of exploitation of less than 1%. It is not listed in the CISA KEV catalog, suggesting no large-scale exploitation has been reported. The attack vector is likely local or requires privileged access, as the vulnerability exploits improper enforcement of workflow for privileged users. Nevertheless, any insider or compromised administrative account could use this flaw to interrupt service availability, making it important for administrators to apply the recommended patch promptly."}}}}, "created": "2026-03-16T09:24:03.601864+00:00", "updated": "2026-03-23T13:40:04.075413+00:00", "vendors": ["ibm", "ibm$PRODUCT$aspera_console"]}