CVE-2021-29872: Medium severity ibm cloud pak for automation vulnerability
IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.
Other sources
IBM ICP4A - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-29872?
CVE-2021-29872 is a vulnerability in IBM Cloud Pak for Automation version 21.0.1 and 21.0.2 Business Automation Studio component that allows remote attackers to inject HTTP headers.
How severe is CVE-2021-29872?
CVE-2021-29872 has a severity rating of 5.4, which is considered medium.
How can I fix CVE-2021-29872?
To fix CVE-2021-29872, update to IBM Cloud Pak for Automation version 21.0.1 IF00721.0.2 IF007 or later.
What is HTTP header injection?
HTTP header injection is a vulnerability that allows an attacker to manipulate or inject malicious headers in an HTTP request or response.
Where can I find more information about CVE-2021-29872?
For more information about CVE-2021-29872, you can visit the IBM X-Force Exchange or the IBM support page provided in the references.