PT-2022-10814
CVE-2021-38944
·
تاريخ النشر
2022-05-18
·
تاريخ التحديث
2022-05-26
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.5
IBM DataPower Gateway versions 10.0.2.0 through 1.0.3.0
IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.18
Description
The issue is caused by improper validation of input by the HOST headers, leading to HTTP header injection. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.
Recommendations
For IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.5, update to a version that properly validates input by the HOST headers.
For IBM DataPower Gateway versions 10.0.2.0 through 1.0.3.0, update to a version that properly validates input by the HOST headers.
For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.18, update to a version that properly validates input by the HOST headers.
As a temporary workaround, consider restricting access to the HOST headers to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾