Main Vulnerability Database SB2022070711

SB2022070711 - Inconsistent interpretation of HTTP requests in IBM CICS TX Standard

Published: July 7, 2022

Security Bulletin ID SB2022070711

Severity

Low

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2022-34306)

The vulnerability allows a remote user to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote user can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Remediation

Install update from vendor's website.

References

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cics-tx-standard-is-vulnerable-to-http-header-injection-cve-2022-34306/"
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cics-tx-standard-is-vulnerable-to-http-header-injection-cve-2022-34306/</a> <a
https://www.ibm.com/support/pages/node/6601659"
https://www.ibm.com/support/pages/node/6601659</a>