CVE-2020-4433

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-787

Affected software

VendorProductVersions
IBMAspera Faspex On Demand3.7.4
IBMAspera Server On Demand3.7.4
IBMAspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)3.9.10
IBMAspera High-Speed Transfer Endpoint3.9.3
IBMAspera Streaming3.9.3
IBMAspera Transfer Cluster Manager1.3.1
IBMAspera High-Speed Transfer Server3.9.3
IBMAspera Shares On Demand3.7.4
IBMAspera Application Platform On Demand3.7.4
IBMAspera Proxy Server1.4.3

References

Timeline

Published
Jun 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-44347.5Certain IBM Aspera applications are vulnerable to buffer overflow based on the product configuration and valid authentication, which could aCVE-2020-44357.5Certain IBM Aspera applications are vulnerable to arbitrary memory corruption based on the product configuration, which could allow an attacCVE-2020-44367.5Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knCVE-2020-44455.4IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScripCVE-2020-44464.3IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass seCVE-2020-44475.4IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScCVE-2020-44489.8IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the syCVE-2020-44497.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a speCVE-2020-44509.8IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a speciaCVE-2020-44527.5IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hCVE-2020-44599.8IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound CVE-2020-44616.5IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation
CVE-2020-4433: High severity, CVSS 7.5 | Vulnix