CVE-2019-4186 — Cross-site Scripting in IBM Jazz FOR Service Management

CWE-79 — Cross-site Scripting5 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 75.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Jazz FOR Service Management
Timeline
PublishedSep 5
Latest updateMay 24

Description

IBM Jazz for Service Management 1.1.3 is vulnerable to HTTP header injection, caused by incorrect trust in the HTTP Host header during caching. By sending a specially crafted HTTP GET request, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-force ID: 158976.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDibm/jazz1.1.3

🔴Vulnerability Details

4
GHSA
GHSA-9m4g-67v5-8rww: IBM Jazz for Service Management 1↗2022-05-24
▶
OSV
linux vulnerability↗2019-11-13
▶
OSV
linux-lts-xenial, linux-aws vulnerabilities↗2019-11-13
▶
CVEList
CVE-2019-4186: IBM Jazz for Service Management 1↗2019-09-05
▶
CVE-2019-4186 — Cross-site Scripting in IBM | cvebase