CVE-2025-13213

IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7263083	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:ibm:aspera_orchestrator:*:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

History

12 Mar 2026, 15:19

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ibm:aspera_orchestrator:::::::: cpe:2.3:o:linux:linux_kernel:-:::::::*
First Time		Linux Ibm aspera Orchestrator Ibm Linux linux Kernel
References	~~() https://www.ibm.com/support/pages/node/7263083 -~~	() https://www.ibm.com/support/pages/node/7263083 - Vendor Advisory

11 Mar 2026, 13:52

Type	Values Removed	Values Added
Summary		(es) IBM Aspera Orchestrator 3.0.0 hasta 4.1.2 es vulnerable a la inyección de encabezados HTTP, causada por la validación inadecuada de la entrada por parte de los encabezados HOST. Esto podría permitir a un atacante llevar a cabo varios ataques contra el sistema vulnerable, incluyendo cross-site scripting, envenenamiento de caché o secuestro de sesión.

10 Mar 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-10 21:16

Updated : 2026-03-12 15:19

NVD link : CVE-2025-13213

Mitre link : CVE-2025-13213

CVE.ORG link : CVE-2025-13213

JSON object : View

Products Affected

linux

linux_kernel

ibm

aspera_orchestrator

CWE

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

{"id": "CVE-2025-13213", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2026-03-10T21:16:40.060", "references": [{"url": "https://www.ibm.com/support/pages/node/7263083", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-644"}]}], "descriptions": [{"lang": "en", "value": "IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,\u00a0including cross-site scripting, cache poisoning or session hijacking"}, {"lang": "es", "value": "IBM Aspera Orchestrator 3.0.0 hasta 4.1.2 es vulnerable a la inyecci\u00f3n de encabezados HTTP, causada por la validaci\u00f3n inadecuada de la entrada por parte de los encabezados HOST. Esto podr\u00eda permitir a un atacante llevar a cabo varios ataques contra el sistema vulnerable, incluyendo cross-site scripting, envenenamiento de cach\u00e9 o secuestro de sesi\u00f3n."}], "lastModified": "2026-03-12T15:19:16.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3C74FAB-D7CA-40CE-B806-903220497FD9", "versionEndExcluding": "4.1.3", "versionStartIncluding": "3.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}