Security Bulletin: HTTP Response Splitting in Liberty affects IBM MessageSight (CVE-2016-0359)

Summary

There is a potential HTTP response splitting vulnerability in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVE.

Vulnerability Details

CVEID: CVE-2016-0359 DESCRIPTION: IBM WebSphere Application Server is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information.
CVSS Base Score: 6.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/111929&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

IBM MessageSight V1.1 - 1.1.0.1, IBM MessageSight V1.2 - 1.2.0.3, IBM MessageSight V2.0

Remediation/Fixes

Product

|
VRMF|
APAR|
Remediation/First Fix
—|—|—|—
IBM MessageSight| 1.1| IT17110| 1.1.0.1-IBM-IMA-IFIT17110

IBM MessageSight|
1.2| IT17109| 1.2.0.3-IBM-IMA-IFIT17109
IBM MessageSight| 2.0| IT17111| 2.0.0-IBM-IMA-FP0001

Workarounds and Mitigations

None