PT-2020-10966 · Ibm · Ibm Security Verify Access+1

Published 2020-10-15 · Updated 2020-10-20 · CVE-2019-4552

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager version 9.0.7 IBM Security Verify Access version 10.0.0

Description The issue allows a remote attacker to perform HTTP response splitting attacks by using a specially-crafted URL. Once the URL is clicked, the server returns a split response, enabling the attacker to conduct further attacks, including Web cache poisoning, cross-site scripting, and potentially obtaining sensitive information.

Recommendations For IBM Security Access Manager version 9.0.7, update to a version that includes the fix for this issue. For IBM Security Verify Access version 10.0.0, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to URLs that could be used to exploit this issue until a patch is available.

Fix

Related Identifiers

CVE-2019-4552

Affected Products

Ibm Security Access Manager

Ibm Security Verify Access

References · 4

• https://ibm.com/support/pages/node/6348046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4552 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4552 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/165960 · Note