CVE-2021-29872: ibm cloud_pak_for_automation Improper Encoding or Escaping of Output

Vulnerability summary

CVE-2021-29872 is a medium (CVSS 5.4) Improper Encoding or Escaping of Output vulnerability in ibm cloud_pak_for_automation. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 55.1% of scored vulnerabilities.

Timeline

1. 18-01-2022
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.

• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.