Main Vulnerability Database Vulnerabilities #VU85296

Inconsistent interpretation of HTTP requests in protocol-http1 - CVE-2023-38697

Published: January 11, 2024

Vulnerability identifier: #VU85296

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-38697

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Affected software

protocol-http1
Cloud Pak for Network Automation

How to mitigate CVE-2023-38697

Install updates from vendor's website.

protocol-http1 - update to 0.15.1
Cloud Pak for Network Automation - update to 2.6.4

External References

Related Security Bulletins