CVE-2020-4433: IBM Aspera Application Platform On Demand

High severity, CVSS 7.5. EPSS: 5.1% chance of exploitation in the next 30 days.

Certain IBM Aspera applications are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. This could allow a remote attacker with intimate knowledge of the server to execute arbitrary code on the system with the privileges of root or cause server to crash. IBM X-Force ID: 180814.

Affected products

• IBM Aspera Application Platform On Demand: up to and including 3.7.4
• IBM Aspera Faspex On Demand: up to and including 3.7.4
• IBM Aspera High-Speed Transfer Endpoint: up to and including 3.9.3
• IBM Aspera High-Speed Transfer Server: up to and including 3.9.3
• IBM Aspera High-Speed Transfer Server For Cloud Pak For Integration: up to and including 3.9.10
• IBM Aspera Proxy Server: up to and including 1.4.3
• IBM Aspera Server On Demand: up to and including 3.7.4
• IBM Aspera Shares On Demand: up to and including 3.7.4
• IBM Aspera Streaming: up to and including 3.9.3
• IBM Aspera Transfer Cluster Manager: up to and including 1.3.1

Published 2020-06-10. Last modified 2026-06-17.