CVE-2020-4436

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Certain IBM Aspera applications are vulnerable to buffer overflow after valid authentication, which could allow an attacker with intimate knowledge of the system to execute arbitrary code through a service. IBM X-Force ID: 180902.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
IBMAspera Faspex On Demand3.7.4
IBMAspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I)3.9.10
IBMAspera High-Speed Transfer Endpoint3.9.3
IBMAspera Streaming3.9.3
IBMAspera Server On Demand3.7.4
IBMAspera Shares On Demand3.7.4
IBMAspera Application Platform On Demand3.7.4
IBMAspera Transfer Cluster Manager1.3.1
IBMAspera High-Speed Transfer Server3.9.3
IBMAspera Proxy Server1.4.3

References

Timeline

Published
Jun 10, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-44455.4IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScripCVE-2020-44464.3IBM Business Process Manager 8.0, 8.5, and 8.6 and IBM Business Automation Workflow 18.0 and 19.0 could allow a remote attacker to bypass seCVE-2020-44475.4IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScCVE-2020-44489.8IBM WebSphere Application Server Network Deployment 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to execute arbitrary code on the syCVE-2020-44497.5IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a speCVE-2020-44509.8IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a speciaCVE-2020-44527.5IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hCVE-2020-44599.8IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound CVE-2020-44616.5IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation CVE-2020-44628.2IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 arCVE-2020-44638.2IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rCVE-2020-44648.8IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with
CVE-2020-4436: High severity, CVSS 7.5 | Vulnix