IBM41FD21C3496AF41E8AFB2C26EE0CEE249A52A5CCCFFE92C19C9A7EC8DC88F18ESecurity Bulletin: IBM CICS TX Advanced is vulnerable to attack due to missing or insecurely formatted HTTP headers (CVE-2022-34316).
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
32.6%
Summary
IBM CICS TX Advanced could allow an attack due to missing or insecurely formatted HTTP headers. The fix removes this vulnerability (CVE-2022-34316) from IBM CICS TX Advanced.
Vulnerability Details
CVEID:CVE-2022-34316
**DESCRIPTION:**IBM CICS TX does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229452 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM CICS TX Advanced | 11.1 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability by downloading and applying the interim fixes from the table below
Product
|
Version
|
Defect
|
Remediation / First Fix
—|—|—|—
IBM CICS TX Advanced
|
11.1
|
127920
|
Workarounds and Mitigations
None
Affected configurations
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
Percentile
32.6%