CVE-2023-35894: IBM Control Center HOST header injection
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
Other sources
IBM Sterling Control Center is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35894?
CVE-2023-35894 is considered a high severity vulnerability due to the potential for various attacks such as cross-site scripting and cache poisoning.
How do I fix CVE-2023-35894?
To fix CVE-2023-35894, upgrade IBM Control Center to version 6.3.1 or apply the available patches for versions 6.2.1 and 6.3.1.
Which versions of IBM Control Center are affected by CVE-2023-35894?
CVE-2023-35894 affects IBM Control Center versions 6.2.1 through 6.3.1.
What types of attacks can CVE-2023-35894 facilitate?
CVE-2023-35894 can facilitate attacks such as cross-site scripting, session hijacking, and cache poisoning.
Is there a workaround for CVE-2023-35894?
Currently, there are no official workarounds for CVE-2023-35894; the recommended action is to apply the patches or upgrade the software.