VULNERABILITY INTELLIGENCE

CVE-2022-47986

CVSS score9.8 CRITICAL
EPSS probability99.97%
CISA KEVKnown exploited vulnerability
Published2023-02-17
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

IBM Aspera Faspex Code Execution Vulnerability

Vendor / product: IBM / Aspera Faspex

Description

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Weakness classification

  • psirt@us.ibm.com: CWE-502

Primary references