CVE-2021-38997 — Improper Neutralization of HTTP Headers for Scripting Syntax in IBM API Connect

CWE-644 — Improper Neutralization of HTTP Headers for Scripting Syntax CWE-116 — Improper Encoding or Escaping of Output3 documents3 sources

Severity

5.4MEDIUMNVD

EPSS

0.3%

top 47.77%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM API Connect

Timeline

PublishedDec 12

Description

IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 213212.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5ibm/api_connect10.0.0.0 — 10.0.5.0+2

▶NVDibm/api_connect10.0.0.0 — 10.0.5.0+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-56xq-39jp-p7r8: IBM API Connect V10↗2022-12-12

▶

CVEList

IBM API Connect HOST header injection↗2022-12-01

▶