CVE-2021-29872

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of…

Medium · published January 18, 2022

CVSS v3.0
5.4
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/C:L/AC:L/PR:L/I:L/UI:N/S:U/A:N/RC:C/E:U/RL:O
CVSS v4.0
Not supplied
EPSS
0.00771 · 55.2th percentile
Published
2022-01-18T16:50Z
EPSS history
Timeline
  • 18 JAN 16:50Z
    IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of…
    cvelistv5