CVE-2022-34163

IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229333.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/229333	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6608200	Patch Vendor Advisory
https://www.ibm.com/support/pages/node/6608202	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:cics_tx:11.1::::advanced:::
	cpe:2.3:a:ibm:cics_tx:11.1::::standard:::

History

06 Aug 2022, 02:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
First Time		Ibm Ibm cics Tx
CPE		cpe:2.3:a:ibm:cics_tx:11.1::::standard::: cpe:2.3:a:ibm:cics_tx:11.1::::advanced:::
References	~~(CONFIRM) https://www.ibm.com/support/pages/node/6608200 -~~	(CONFIRM) https://www.ibm.com/support/pages/node/6608200 - Patch, Vendor Advisory
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/229333 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/229333 - VDB Entry, Vendor Advisory
References	~~(CONFIRM) https://www.ibm.com/support/pages/node/6608202 -~~	(CONFIRM) https://www.ibm.com/support/pages/node/6608202 - Patch, Vendor Advisory
CWE		CWE-79

01 Aug 2022, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-01 16:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-34163

Mitre link : CVE-2022-34163

CVE.ORG link : CVE-2022-34163

JSON object : View

Products Affected

ibm

cics_tx

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-34163", "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2022-08-01T16:15:07.230", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/229333", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6608200", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6608202", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 229333."}, {"lang": "es", "value": "IBM CICS TX versi\u00f3n 11.1, es vulnerable a la inyecci\u00f3n de cabeceras HTTP, causada por la incorrecta comprobaci\u00f3n de la entrada de los encabezados HOST. Esto podr\u00eda permitir a un atacante llevar a cabo varios ataques contra el sistema vulnerable, incluyendo de tipo cross-site scripting, envenenamiento de cach\u00e9 o secuestro de sesi\u00f3n. IBM X-Force ID: 229333"}], "lastModified": "2022-08-06T02:35:49.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cics_tx:11.1:*:*:*:advanced:*:*:*", "vulnerable": true, "matchCriteriaId": "A9D7FDA3-EE60-453B-8651-686B9D28071F"}, {"criteria": "cpe:2.3:a:ibm:cics_tx:11.1:*:*:*:standard:*:*:*", "vulnerable": true, "matchCriteriaId": "66EEC046-128D-4555-8C9A-3C02300145B5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}