CVE-2017-1262: ibm security_guardium HTTP Request/Response Splitting

Vulnerability summary

CVE-2017-1262 is a medium (CVSS 6.1) HTTP Request/Response Splitting vulnerability in ibm security_guardium. EPSS estimates a 1.34% chance of exploitation in the next 30 days, higher than 71% of scored vulnerabilities.

Timeline

1. 20-12-2017
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

IBM Security Guardium 10.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 124737.

• CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.