HTTP response splitting in API Gateway and API Manager - #VU74262
Published: March 31, 2023
Vulnerability identifier: #VU74262
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform HTTP splitting attacks.
The vulnerability exists due to software does not correclty process CRLF character sequences. A remote attacker can send specially crafted request containing CRLF sequence and make the application to send a split HTTP response.
Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.
Affected software
API Gateway
API Manager
API Manager
Remediation
Install updates from vendor's website.
API Gateway - update to May 2022
API Manager - update to May 2022
API Manager - update to May 2022