CVE-2022-34362
Assigner: ibm
Published: 2023-02-08T18:30:03.902Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Sterling Secure Proxy
vendor: IBM
versions: status: affected
version: 6.0.3
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(204, 217, 226);">IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.</span>


value: 
IBM Sterling Secure Proxy 6.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 230523.


metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: description: 644 Improper Neutralization of HTTP Headers for Scripting Syntax
source: discovery: UNKNOWN
title: IBM Sterling Secure Proxy HOST header injection
x_generator: engine: Vulnogram 0.1.0-dev