PT-2022-10836 · Ibm · Ibm Api Connect

Published 2022-12-01 · Updated 2022-12-13 · CVE-2021-38997

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 10.0.0.0 through 10.0.5.0 IBM API Connect versions 10.0.1.0 through 10.0.1.7 IBM API Connect versions 2018.4.1.0 through 2018.4.1.19

Description The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.

Recommendations For versions 10.0.0.0 through 10.0.5.0, update to a version outside of this range to resolve the issue. For versions 10.0.1.0 through 10.0.1.7, update to a version outside of this range to resolve the issue. For versions 2018.4.1.0 through 2018.4.1.19, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the HOST headers to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-644

Related Identifiers

CVE-2021-38997

Affected Products

Ibm Api Connect

References · 5

• https://osv.dev/vulnerability/CVE-2021-38997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38997 · Security Note
• https://ibm.com/support/pages/node/6842621 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/213212 · Vendor Advisory
• https://t.me/cvenotify/39765 · Telegram Post