CVE-2019-4396

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 162236.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/162236	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/1096354	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:cloud_orchestrator:::::-:::*
	cpe:2.3:a:ibm:cloud_orchestrator:::::enterprise:::*
	cpe:2.3:a:ibm:cloud_orchestrator:::::-:::*
	cpe:2.3:a:ibm:cloud_orchestrator:::::enterprise:::*

History

No history.

Information

Published : 2019-10-25 17:15

Updated : 2024-02-04 20:39

NVD link : CVE-2019-4396

Mitre link : CVE-2019-4396

CVE.ORG link : CVE-2019-4396

JSON object : View

Products Affected

ibm

cloud_orchestrator

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2019-4396", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2019-10-25T17:15:11.350", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162236", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/1096354", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 162236."}, {"lang": "es", "value": "IBM Cloud Orchestrator versiones 2.4 hasta 2.4.0.5 y versiones 2.5 hasta 2.5.0.9, es vulnerable a ataques de divisi\u00f3n de respuesta HTTP, causados ??por una comprobaci\u00f3n inapropiada de la entrada suministrada por el usuario. Un atacante remoto podr\u00eda explotar esta vulnerabilidad para inyectar encabezados HTTP arbitrarios y hacer que el servidor devuelva una respuesta dividida, una vez que la URL sea cliqueada. Esto permitir\u00eda al atacante realizar futuros ataques, tales como el envenenamiento de la memoria cach\u00e9 Web o un cross-site scripting , y posiblemente obtener informaci\u00f3n confidencial. ID de IBM X-Force: 162236."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cloud_orchestrator:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "C122C107-AD04-48A7-8C95-9907063E45F8", "versionEndIncluding": "2.4.0.5", "versionStartIncluding": "2.4.0.0"}, {"criteria": "cpe:2.3:a:ibm:cloud_orchestrator:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A033CBB2-4F3C-43D9-A0C4-E0DDFB4EE702", "versionEndIncluding": "2.4.0.5", "versionStartIncluding": "2.4.0.0"}, {"criteria": "cpe:2.3:a:ibm:cloud_orchestrator:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "E61F3D16-BB6E-4FA4-A3C2-A05F3C613C8A", "versionEndIncluding": "2.5.0.9", "versionStartIncluding": "2.5.0.0"}, {"criteria": "cpe:2.3:a:ibm:cloud_orchestrator:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6661F2D4-F106-4FA9-B40D-CDD562FCAE91", "versionEndIncluding": "2.5.0.9", "versionStartIncluding": "2.5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}