HTTP Header Injection Vulnerability in IBM Maximo Asset Management

CVE-2021-29854

Summary

IBM Maximo Asset Management versions 7.6.1.1 and 7.6.1.2 are susceptible to an HTTP header injection flaw due to improper validation of input from the HOST headers. By sending a maliciously crafted HTTP request, an attacker can inject an HTTP HOST header, potentially leading to a range of attacks, including cross-site scripting, cache poisoning, or session hijacking. This vulnerability poses significant risks for deploying secure applications and systems reliant on affected versions.

References