CVE-2023-45190: IBM Engineering Lifecycle Optimization HTTP header injection
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 268754.
Other sources
IBM Engineering Lifecycle Optimization is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45190?
CVE-2023-45190 has been classified as a high severity vulnerability due to its potential to allow various attacks, including cross-site scripting.
How do I fix CVE-2023-45190?
To fix CVE-2023-45190, update the IBM Engineering Lifecycle Optimization software to versions 7.0.4 or later, which address the HTTP header injection issue.
Which versions of IBM Engineering Lifecycle Optimization are affected by CVE-2023-45190?
CVE-2023-45190 affects IBM Engineering Lifecycle Optimization versions 7.0.2 and 7.0.3.
What types of attacks can be conducted due to CVE-2023-45190?
CVE-2023-45190 can enable attackers to conduct cross-site scripting and cache poisoning attacks.
Is there a workaround for CVE-2023-45190 if immediate patching is not possible?
While a specific workaround is not provided, reducing exposure by restricting access to the affected service can help mitigate risks until a patch is applied.