CVE-2019-4552 IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted UR...
MediumCVSS 6.1
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 165960.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm security access manager | >= 9.0.7.0, < 9.0.7.2 | 9.0.7.2 |
| ibm security verify access | >= 10.0.0, < 10.0.0.1 | 10.0.0.1 |
| ibm security verify access | = 10.0.0 | No fix listed |
| ibm security access manager | = 9.0.7 | No fix listed |
References
- ibm-sam-cve20194552-response-splitting (165960) vdb-entry
- www.ibm.com patch vendor-advisory