CVE-2023-47143 | IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 … | CVSS 10.0 CRITICAL

Description

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 270270.

Metadata

CVE ID: CVE-2023-47143
State: PUBLISHED
Assigner: ibm
Reserved: 2023-10-31 00:13 UTC
Published: 2024-02-02 13:03 UTC
Last updated: 2024-08-02 21:01 UTC
Primary CWE: CWE-644
CWE-644 Improper Neutralization of HTTP Headers for Scriptin…
Vendor / Product: IBM / Tivoli Application Dependency Discovery Manager
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
IBM	Tivoli Application Dependency Discovery Manager	—	7.3.0.0 ≤ 7.3.0.10

Weakness (CWE)

CWE	Source	Description
CWE-644	cna	CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)