CVE-2025-66483

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-66483", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-12-02T18:42:37.816Z", "datePublished": "2026-04-01T22:56:38.441Z", "dateUpdated": "2026-04-02T13:33:16.193Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-01T22:56:38.441Z"}, "title": "Multiple vulnerabilities have been addressed in IBM Aspera Shares", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Aspera Shares", "versions": [{"status": "affected", "version": "1.9.9", "lessThanOrEqual": "1.11.0", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:aspera_shares:1.9.9:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_shares:1.11.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267848", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "Product(s)Fixing VRMPlatformLink to FixIBM Aspera Shares1.11.1\n\nWindows click here https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Aspera Shares1.11.1\n\nLinux click here https://www.ibm.com/support/fixcentral/swg/selectFixes", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><br></p><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Fixing VRM</strong></td><td><strong>Platform</strong></td><td><strong>Link to Fix</strong></td></tr><tr><td>IBM Aspera Shares</td><td><div>1.11.1</div></td><td>Windows</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&amp;product=ibm/Other+software/Aspera+Shares&amp;release=1.11.1&amp;platform=Windows&amp;function=all\" rel=\"nofollow\">click here</a></td></tr><tr><td>IBM Aspera Shares</td><td><div>1.11.1</div></td><td>Linux</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&amp;product=ibm/Other+software/Aspera+Shares&amp;release=1.11.1&amp;platform=Linux&amp;function=all\" rel=\"nofollow\">click here</a></td></tr></tbody></table>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-02T13:28:26.034596Z", "id": "CVE-2025-66483", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:33:16.193Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-66483", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T13:28:26.034596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T13:28:31.166Z"}}], "cna": {"title": "Multiple vulnerabilities have been addressed in IBM Aspera Shares", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:aspera_shares:1.9.9:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_shares:1.11.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Aspera Shares", "versions": [{"status": "affected", "version": "1.9.9", "versionType": "semver", "lessThanOrEqual": "1.11.0"}]}], "solutions": [{"lang": "en", "value": "Product(s)Fixing VRMPlatformLink to FixIBM Aspera Shares1.11.1\n\nWindows click here https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Aspera Shares1.11.1\n\nLinux click here https://www.ibm.com/support/fixcentral/swg/selectFixes", "supportingMedia": [{"type": "text/html", "value": "<p><br></p><table><tbody><tr><td><strong>Product(s)</strong></td><td><strong>Fixing VRM</strong></td><td><strong>Platform</strong></td><td><strong>Link to Fix</strong></td></tr><tr><td>IBM Aspera Shares</td><td><div>1.11.1</div></td><td>Windows</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&amp;product=ibm/Other+software/Aspera+Shares&amp;release=1.11.1&amp;platform=Windows&amp;function=all\" rel=\"nofollow\">click here</a></td></tr><tr><td>IBM Aspera Shares</td><td><div>1.11.1</div></td><td>Linux</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&amp;product=ibm/Other+software/Aspera+Shares&amp;release=1.11.1&amp;platform=Linux&amp;function=all\" rel=\"nofollow\">click here</a></td></tr></tbody></table>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267848", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613 Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-04-01T22:56:38.441Z"}}}, "cveMetadata": {"cveId": "CVE-2025-66483", "state": "PUBLISHED", "dateUpdated": "2026-04-02T13:33:16.193Z", "dateReserved": "2025-12-02T18:42:37.816Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-04-01T22:56:38.441Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:aspera_shares:1.9.9:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:aspera_shares:1.11.0:*:*:*:*:*:*:*"], "product": "Aspera Shares", "vendor": "IBM", "versions": [{"lessThanOrEqual": "1.11.0", "status": "affected", "version": "1.9.9", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_shares:*:-:*:*:*:*:*:*", "matchCriteriaId": "43D7FC27-FB60-411F-A477-5D21D30548C3", "versionEndIncluding": "1.11.0", "versionStartIncluding": "1.9.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system."}, {"lang": "es", "value": "IBM Aspera Shares 1.9.9 hasta 1.11.0 no invalida la sesi\u00f3n despu\u00e9s de un restablecimiento de contrase\u00f1a, lo que podr\u00eda permitir a un usuario autenticado suplantar a otro usuario en el sistema."}], "id": "CVE-2025-66483", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66483", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-02T13:28:26.034596Z", "version": "2.0.3"}}]}, "published": "2026-04-01T23:17:01.940", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7267848"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.9.9,1.11.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Aspera Shares", "source": "cna", "vendor": "IBM"}, "product": "aspera_shares", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-06T19:27:46.624946+00:00", "value": {"mitigation_remediation": ["Apply the IBM Aspera Shares 1.11.1 patch for Windows using the provided fix link.", "Apply the IBM Aspera Shares 1.11.1 patch for Linux using the provided fix link.", "Verify that the installed version is at least 1.11.1 and no earlier versions are in use."], "summary": {"action": "Apply Patch", "impact": "User Impersonation"}, "threat_synthesis": {"affected_systems": "The affected product is IBM Aspera Shares on both Windows and Linux platforms. Users running any release from 1.9.9 up to and including 1.11.0 are vulnerable; newer releases such as 1.11.1 contain the fix.", "description_and_impact": "A flaw in IBM Aspera Shares versions 1.9.9 through 1.11.0 causes the system to fail to invalidate a session after a password reset. An authenticated user who resets a password can continue to use the session to act as another user, potentially accessing data or functionalities that belong to that other account. The weakness is a lack of session invalidation, identified as CWE\u2011613.", "risk_and_exploitability": "The vulnerability scores a CVSS of 6.3, placing it in the medium severity range, and the EPSS indicates an exploitation probability of less than 1%. It is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to be an authenticated user with the ability to reset a password; once that condition is met, the attacker can impersonate any other user without needing additional privileges."}}}}, "created": "2026-04-02T07:47:05.872146+00:00", "updated": "2026-04-07T07:56:25.219340+00:00", "vendors": ["ibm", "ibm$PRODUCT$aspera_shares"]}