IBM InfoSphere Information Server HTTP Header Injection Vulnerability Allowing Cross-Site Scripting and Session Hijacking

A vulnerability has been identified in IBM InfoSphere Information Server versions 11.7.0.0 prior to 11.7.1.6, allowing HTTP header injection. This issue arises from inadequate validation of input in the HOST headers. Exploitation of this vulnerability could enable an attacker to perform various attacks on the affected system, such as cross-site scripting, cache poisoning, or session hijacking.

Impact

Exploitation of this vulnerability could lead to HTTP header injection, allowing for cross-site scripting, cache poisoning, or session hijacking.

Remediation

Users can upgrade to IBM InfoSphere Information Server versions 11.7.1.0, 11.7.1.6, or 11.7.1.6 Service Pack 2. Instructions for downloading these versions are available on the IBM Support website.