CVE-2025-13460

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13460", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-11-19T21:22:07.209Z", "datePublished": "2026-03-13T19:54:04.254Z", "dateUpdated": "2026-03-16T13:50:17.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:54:04.254Z"}, "title": "IBM Aspera Console Information Disclosure", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-204", "description": "CWE-204 Observable Response Discrepancy", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Aspera Console", "versions": [{"status": "affected", "version": "3.3.0", "lessThanOrEqual": "3.4.8", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263486", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link</p>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T13:50:04.891504Z", "id": "CVE-2025-13460", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:50:17.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13460", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:50:04.891504Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:50:13.219Z"}}], "cna": {"title": "IBM Aspera Console Information Disclosure", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Aspera Console", "versions": [{"status": "affected", "version": "3.3.0", "versionType": "semver", "lessThanOrEqual": "3.4.8"}]}], "solutions": [{"lang": "en", "value": "Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link", "supportingMedia": [{"type": "text/html", "value": "<p>Remediation/Fixes It is strongly recommended that customers upgrade to the latest version of IBM Aspera Console: Product(s) Fixing VRM Platform Link to Fix IBM Aspera Console 3.4.9 Windows Link IBM Aspera Console 3.4.9 Linux Link</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263486", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204 Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T19:54:04.254Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13460", "state": "PUBLISHED", "dateUpdated": "2026-03-16T13:50:17.157Z", "dateReserved": "2025-11-19T21:22:07.209Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-13T19:54:04.254Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:aspera_console:3.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_console:3.4.8:*:*:*:*:*:*:*"], "product": "Aspera Console", "vendor": "IBM", "versions": [{"lessThanOrEqual": "3.4.8", "status": "affected", "version": "3.3.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_console:*:*:*:*:*:*:*:*", "matchCriteriaId": "51419171-DDAE-4AA6-9109-0582F2133296", "versionEndExcluding": "3.4.9", "versionStartIncluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy."}, {"lang": "es", "value": "IBM Aspera Console 3.3.0 hasta 3.4.8 podr\u00eda permitir a un atacante enumerar nombres de usuario debido a una discrepancia observable en la respuesta."}], "id": "CVE-2025-13460", "lastModified": "2026-06-17T08:34:11.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13460", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T13:50:04.891504Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:54.903", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7263486"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.3.0,3.4.8]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Aspera Console", "source": "cna", "vendor": "IBM"}, "product": "aspera_console", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-03-17T17:51:25.408575+00:00", "value": {"mitigation_remediation": ["Upgrade IBM Aspera Console to version 3.4.9 for Windows and Linux", "Verify that the latest version is installed and running", "If immediate upgrade is not possible, monitor for enumeration attempts and restrict access to the console"], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "IBM Aspera Console versions 3.3.0 through 3.4.8 are affected on both Windows and Linux platforms. Versions higher than 3.4.8, such as 3.4.9, include the remediation and are not vulnerable.", "description_and_impact": "The vulnerability allows an attacker to enumerate usernames due to an observable response discrepancy. This information disclosure is classified as CWE\u2011204 and could expose user identities, enabling potential social engineering or further attacks. The impact is limited to disclosure of sensitive information and does not provide direct code execution or privilege escalation.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate risk, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the vulnerability via a remote network request to the console, without needing local privileges. The nature of the response discrepancy suggests that enumeration may be possible even without authentication, though the exact scope depends on the console configuration."}}}}, "created": "2026-03-16T09:24:05.085886+00:00", "updated": "2026-03-23T13:40:05.022348+00:00", "vendors": ["ibm", "ibm$PRODUCT$aspera_console"]}