CVE-2025-66483CWE-613

CVE-2025-66483

Medium · published April 2, 2026

CVSS v3.1

6.3

EPSS

Percentile

6.8

In the wild

Unconfirmed

What it is

IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00176 · 6.8th percentile
Weakness: CWE-613 · Insufficient Session Expiration
Published: 2026-04-02T03:17Z

Affected products (1)

Product	Versions	Fixed in
ibm/aspera_shares	≥ 1.9.9, ≤ 1.11.0	—

References (1)

https://www.ibm.com/support/pages/node/7267848 · [email protected]

EPSS history

Timeline

01 APR 22:56Z
Multiple vulnerabilities have been addressed in IBM Aspera Shares
cvelistv5