CVE-2023-45190: IBM Engineering Lifecycle Optimization HTTP header injection
First published: Wed Feb 07 2024(Updated: )
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 268754.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Pub | <=7.0.3 | |
| IBM Pub | <=7.0.2 | |
| IBM Engineering Lifecycle Optimization | =7.0.2 | |
| IBM Engineering Lifecycle Optimization | =7.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-45190?
CVE-2023-45190 has been classified as a high severity vulnerability due to its potential to allow various attacks, including cross-site scripting.
How do I fix CVE-2023-45190?
To fix CVE-2023-45190, update the IBM Engineering Lifecycle Optimization software to versions 7.0.4 or later, which address the HTTP header injection issue.
Which versions of IBM Engineering Lifecycle Optimization are affected by CVE-2023-45190?
CVE-2023-45190 affects IBM Engineering Lifecycle Optimization versions 7.0.2 and 7.0.3.
What types of attacks can be conducted due to CVE-2023-45190?
CVE-2023-45190 can enable attackers to conduct cross-site scripting and cache poisoning attacks.
Is there a workaround for CVE-2023-45190 if immediate patching is not possible?
While a specific workaround is not provided, reducing exposure by restricting access to the affected service can help mitigate risks until a patch is applied.
- agent/references
- agent/title
- agent/type
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/remedy
- agent/weakness
- agent/severity
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/ibm
- canonical/ibm pub
- version/ibm pub/7.0.3
- version/ibm pub/7.0.2
- canonical/ibm engineering lifecycle optimization
- version/ibm engineering lifecycle optimization/7.0.2
- version/ibm engineering lifecycle optimization/7.0.3