by Kastro
Paper/Archive/CVE-2023-47143

CVE-2023-47143

IBM Tivoli Application Dependency Discovery Manager — IBM Tivoli Application Dependency Discovery Manager HOST header injection

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
41
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 56.1.561 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270.

Affected

ProductAffectedFixed inSource
Tivoli Application Dependency Discovery Manager7.3.0.0 – 7.3.0.10–CNA

Scores by source

ibm (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryibm.com/support/pages/node/7105139refexchange.xforce.ibmcloud.com/vulnerabilities/270270