CVE-2023-37396: 
IBM Aspera Faspex vulnerability analysis and mitigation

IBM Aspera Faspex versions 5.0.0 through 5.0.7 contain a security vulnerability (CVE-2023-37396) that could allow a local user to obtain sensitive information due to improper encryption of certain data. The vulnerability was disclosed on April 19, 2024, and has been assigned IBM X-Force ID: 259671 (IBM Security Bulletin, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 MEDIUM by NIST NVD, with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. However, IBM Corporation initially assessed it with a lower Base Score of 2.5 LOW and vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) (NVD).

The vulnerability could allow a local user to obtain sensitive information from the system due to improper encryption of certain data. The primary impact is on confidentiality, with no direct impact on system integrity or availability (IBM Security Bulletin).

The vulnerability requires local access and low privileges to exploit. The CVSS temporal score of 2.2 indicates that exploitation is currently unproven, and official fixes are available (X-Force Exchange).

IBM has released version 5.0.8 to address this vulnerability along with several other security issues. It is recommended to upgrade to this version as soon as possible. No specific workarounds have been provided for this vulnerability (IBM Security Bulletin).