IBM Storage Defender HTTP HOST header injection
CVE-2023-50963

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Storage Defender - Data Protect
Vendor
CVE Published:
19 January 2024

Summary

IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 276101.

Affected Version(s)

Storage Defender - Data Protect 1.0.0 <= 1.4.1

References

https://www.ibm.com/support/pages/node/7106918
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/276101
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.