A local attacker can obtain sensitive information because the application transmits data in cleartext, leading to an information disclosure vulnerability identified as CWE-319.

Affected products are IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6, which are operated on Linux platforms.

The CVSS score of 5.1 indicates moderate risk, but the lack of an EPSS score and the fact that it is not listed in the CISA KEV catalog mean that exploitation is currently uncommon. Because the flaw requires local access to the server, the attack vector is a local attacker, and should the attacker obtain local filesystem permissions they can read the transmitted data as it flows through the web application.