Lucene search

IbmCVE-2023-24975

HistoryMar 10, 2023 - 9:15 p.m.

CVE-2023-24975

2023-03-1021:15:14

CWE-20

ibm

web.nvd.nist.gov

ibm

spectrum symphony

7.3

http header

injection

vulnerability

input validation

cross-site scripting

cache poisoning

session hijacking

ibm x-force

nvd

cve-2023-24975

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

27.7%

JSON

IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 247030.

Affected configurations

Nvd

Vulners

Node

ibmspectrum_symphonyMatch7.3.0

VendorProductVersionCPE
ibmspectrum_symphony7.3.0cpe:2.3:a:ibm:spectrum_symphony:7.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	spectrum_symphony	7.3.0	cpe:2.3:a:ibm:spectrum_symphony:7.3.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Spectrum Symphony",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.3"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/247030

www.ibm.com/support/pages/node/6959369

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

27.7%

JSON

Related for CVE-2023-24975