CVE-2022-34362

CWE-79 — Cross-site Scripting (XSS)CWE-20 — Improper Input Validation7 documents5 sources
Severity
4.6MEDIUM
EPSS
0.4%
top 40.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Sterling Secure Proxy
Timeline
PublishedFeb 8

Description

IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 2.1 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5ibm/sterling_secure_proxy6.0.3

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM Sterling Secure Proxy HOST header injection↗2023-02-08
▶
GHSA
GHSA-h63x-q57p-mpgf: IBM Sterling Secure Proxy 6↗2023-02-08
▶
CVE-2022-34362 (MEDIUM CVSS 4.6) | IBM Sterling Secure Proxy 6.0.3 is | cvebase.io