CVE-2020-4432: IBM Aspera Application Platform On Demand

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

Certain IBM Aspera applications are vulnerable to command injection after valid authentication, which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.

Affected products

• IBM Aspera Application Platform On Demand: up to and including 3.7.4
• IBM Aspera Faspex On Demand: up to and including 3.7.4
• IBM Aspera High-Speed Transfer Endpoint: up to and including 3.9.3
• IBM Aspera High-Speed Transfer Server: up to and including 3.9.3
• IBM Aspera High-Speed Transfer Server For Cloud Pak For Integration: up to and including 3.9.10
• IBM Aspera Proxy Server: up to and including 1.4.3
• IBM Aspera Server On Demand: up to and including 3.7.4
• IBM Aspera Shares On Demand: up to and including 3.7.4
• IBM Aspera Streaming: up to and including 3.9.3
• IBM Aspera Transfer Cluster Manager: up to and including 1.3.1

Published 2020-06-10. Last modified 2026-06-17.