CVE-2025-13219

High

IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if…

ibm·CWE-598·Published 2026-03-10

CVSS

7.5

EPSS

0.00

KEV

Exploits

Vendor statements (1)

ibm.com

cve.orgen

232 chars

IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.

NVDes

284 chars

IBM Aspera Orchestrator 3.0.0 hasta 4.1.2 almacena información sensible en parámetros de URL. Esto puede llevar a la revelación de información si partes no autorizadas tienen acceso a las URL a través de los registros del servidor, el encabezado referrer o el historial del navegador.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	5.9	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	5.9	2.2	3.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N