This vulnerability allows a remote attacker to obtain sensitive information by retrieving JavaScript source map files that contain parts of the application source code. The exposed source maps can reveal implementation details, potential hidden functionality, and authentication logic, thereby enabling an attacker to reverse engineer the software or discover confidential data. The primary impact is the compromise of confidentiality for information that should remain internal to the organization.

IBM Aspera Enterprise WebApps, versions 1.0.0 through 1.0.6, inclusive, are affected. No additional versions are listed as vulnerable in the available data.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score is not available, so no estimate of current exploitation probability can be provided. The vulnerability does not appear in CISA’s KEV catalog, suggesting no widespread exploitation at present. Based on the description the attack vector is inferred to be remote, requiring network access to the web application to request the exposed .map files. Once accessed, the attacker gains read‑only visibility to the source code, increasing the likelihood of further reconnaissance or exploitation of other weaknesses.