PT-2021-12164 · Ibm · Ibm Api Connect

Published 2021-08-17 · Updated 2022-07-12 · CVE-2020-4706

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 5.0.0.0 through 5.0.8.10

Description The issue is caused by improper validation of input by the HOST headers, allowing a remote attacker to exploit this vulnerability by sending a specially crafted HTTP request. This enables the attacker to inject HTTP HOST headers, which can lead to various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.

Recommendations For IBM API Connect versions 5.0.0.0 through 5.0.8.10, update to a version that properly validates input by the HOST headers to prevent HTTP header injection. As a temporary workaround, consider restricting access to the HOST headers to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-4706

Affected Products

Ibm Api Connect

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-4706 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4706 · Vendor Advisory
• https://ibm.com/support/pages/node/6481879 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/187194 · Note
• https://t.me/cibsecurity/27425 · Telegram Post
• https://t.me/cvenotify/19524 · Telegram Post