HTTP Response Splitting Vulnerability in IBM BigFix Platform

CVE-2018-1474

Summary

The IBM BigFix Platform versions 9.2.0 through 9.2.14 and 9.5 through 9.5.9 are susceptible to HTTP response splitting due to inadequate validation of user-generated input. An attacker can exploit this flaw to inject arbitrary HTTP headers, leading to the potential of the server returning a split HTTP response. This could enable the attacker to conduct additional malicious actions, including web cache poisoning and cross-site scripting, which could compromise sensitive data. Recommended actions include patching affected versions or enhancing user input validation methods to mitigate the risk.

References