CVE-2019-4396 Other in Cloud Orchestrator

Medium 5.4 Published 25 Oct 2019 Updated 17 Sep 2024

Remote attackers can inject HTTP headers via response splitting in IBM Cloud Orchestrator, enabling cache poisoning or XSS and potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-4396?

CVE-2019-4396 is a medium-severity vulnerability in IBM Cloud Orchestrator, published on 25 Oct 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP response splitting attacks, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 162236.

Weakness: CWE-74

Which versions are affected by CVE-2019-4396?

It affects 1 product.

Products include Ibm Cloud Orchestrator.

How do I fix CVE-2019-4396?

No fix has been published for CVE-2019-4396 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-4396 being exploited?

There is no known exploitation of CVE-2019-4396 in the wild and no public exploit code.

Sources

Also known as GHSA-8mrw-m7v2-fqgm.