CVE-2025-2950CWE-644

IBM i improper HTTP header neutralization

Medium · published April 18, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-644 · Improper Neutralization of HTTP Headers for Scripting Syntax
Published
2025-04-18T14:50Z
EPSS history
Timeline
  • 18 APR 14:50Z
    IBM i improper HTTP header neutralization
    cvelistv5