IBM Concert HTTP Header Injection Vulnerability Allowing Cross-Site Scripting, Cache Poisoning, or Session Hijacking
Vulnerability
A vulnerability in IBM Concert versions 1.0.0 through 2.1.0 allows for HTTP header injection due to inadequate validation of HOST headers. This flaw could enable an attacker to perform various attacks, such as cross-site scripting, cache poisoning, or session hijacking.
Impact
Exploitation of this vulnerability could lead to HTTP header injection, allowing for cross-site scripting, cache poisoning, or session hijacking.
Remediation
Users are advised to upgrade to IBM Concert Software version 2.2.0. This version can be downloaded from the Container software library section of the IBM Entitled Registry (ICR) and installed following the provided instructions for the type of deployment.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.