CVE-2022-22363: IBM Cognos Controller information disclosure
express is vulnerable to HTTP response splitting attacks, caused by the failure to check for newline characters in the response.redirect function. A remote attacker could exploit this vulnerability to inject CRLF characters in to the HTTP response and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
Other sources
IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-22363?
CVE-2022-22363 has a medium severity level due to its potential for HTTP response splitting attacks.
How do I fix CVE-2022-22363?
To fix CVE-2022-22363, update to the latest version of IBM Controller beyond version 11.1.0 and IBM Cognos Controller beyond version 11.0.1.
Which software is affected by CVE-2022-22363?
CVE-2022-22363 affects IBM Controller up to version 11.1.0 and IBM Cognos Controller versions 11.0.0 to 11.0.1.
What type of attack is CVE-2022-22363 associated with?
CVE-2022-22363 is associated with HTTP response splitting attacks due to newline character injection.
Can CVE-2022-22363 be exploited remotely?
Yes, CVE-2022-22363 can be exploited remotely by an attacker injecting CRLF characters into the HTTP response.