CVE-2025-13219CWE-598

Multiple vulnerabilities in IBM Aspera Orchestrator

Medium · published March 10, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
27.0
In the wild
Unconfirmed
What it is

IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.0th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-03-10T20:08Z
EPSS history
Timeline
  • 10 MAR 20:08Z
    Multiple vulnerabilities in IBM Aspera Orchestrator
    cvelistv5