Description
Acunetix determined that the IBM Aspera Faspex is vulnerable to remote code execution due to insecure YAML deserialization. An attacker could exploit this vulnerability using specially-crafted serialized data to execute arbitrary code on the system or to perform a denial of service attack.
Remediation
Upgrade to the latest version of IBM Aspera Faspex
References
Security Bulletin: IBM Aspera Faspex 4.4.2 PL2 has addressed multiple vulnerabilities
Pre-Auth RCE in Aspera Faspex: Case Guide for Auditing Ruby on Rails
Related Vulnerabilities
Django Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2513)
Oracle Database Server CVE-2011-0793 Vulnerability (CVE-2011-0793)
Moodle Other Vulnerability (CVE-2012-3398)
Oracle JRE CVE-2013-5849 Vulnerability (CVE-2013-5849)
Jenkins Improper Certificate Validation Vulnerability (CVE-2017-1000396)