The vulnerability resides in IBM Aspera Shares versions 1.9.9 through 1.11.0 and permits attackers to embed malicious JavaScript code in the web interface. By doing so, an attacker can manipulate the UI and potentially capture credentials that are stored in the session of authenticated users. This stored cross‑site scripting flaw can be used to read sensitive data and compromise the confidentiality of user accounts.

IBM Aspera Shares, specifically the 1.9.9, 1.10.x, and 1.11.0 releases, are affected. The issue is present in all platform builds, including Windows and Linux installations, as indicated by the CPE entries for each version.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the web UI by submitting a payload that is stored and later executed in the context of the logged‑in user. It would require the victim to be authenticated with a trusted session to benefit from the credential theft.