IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
Weakness
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Aspera_orchestrator | Ibm | 4.0.0 (including) | 4.1.1 (excluding) |