CVE-2025-66483
Ibm Aspera Shares 1.9.9 – 1.11.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2025-66483 is a medium-severity Insufficient Session Expiration (CWE-613) vulnerability in Ibm Aspera Shares. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) and IA-11 (Re-authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209178
Vulnerability Data
IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insufficient session expiration after password reset directly enables continued use of valid session tokens for impersonation (alternate authentication material).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires automatic session termination after events such as password reset, eliminating the exact session-invalidity flaw described in CVE-2025-66483.
Mandates re-authentication under organization-defined circumstances including credential changes, blocking continued use of pre-reset sessions.
Enforces access decisions based on current authenticated identity, so a password reset can be used to revoke all prior authorizations tied to the old credential.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Automatic termination of inactive sessions and limits on connection duration shrink the window during which a hijacked or unattended authenticated session can be exploited.