CVE-2022-36775 - Vulnerability Details - OpenCVE

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Security Verify Access Security Verify Access Docker

Configuration 1 [-]

OR	cpe:2.3:a:ibm:security_verify_access:10.0.0.0:::::::*
	cpe:2.3:a:ibm:security_verify_access:10.0.1.0:::::::*
	cpe:2.3:a:ibm:security_verify_access:10.0.2.0:::::::*
	cpe:2.3:a:ibm:security_verify_access:10.0.3.0:::::::*
	cpe:2.3:a:ibm:security_verify_access:10.0.4.0:::::::*
	cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:::::::*
	cpe:2.3:a:ibm:security_verify_access_docker:10.0.1.0:::::::*
	cpe:2.3:a:ibm:security_verify_access_docker:10.0.2.0:::::::*
	cpe:2.3:a:ibm:security_verify_access_docker:10.0.3.0:::::::*
	cpe:2.3:a:ibm:security_verify_access_docker:10.0.4.0:::::::*

No data.

References

Link	Providers
https://exchange.xforce.ibmcloud.com/vulnerabilities/233576
https://www.ibm.com/support/pages/node/6953617

History

Wed, 12 Mar 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2023-02-17T16:22:46.450Z

Updated: 2025-03-12T20:07:43.499Z

Reserved: 2022-07-26T14:04:17.547Z

Link: CVE-2022-36775

Vulnrichment

Updated: 2024-08-03T10:14:28.496Z

NVD

Status : Modified

Published: 2023-02-17T17:15:11.137

Modified: 2024-11-21T07:13:40.707

Link: CVE-2022-36775

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-36775", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2022-07-26T14:04:17.547Z", "datePublished": "2023-02-17T16:22:46.450Z", "dateUpdated": "2025-03-12T20:07:43.499Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Security Verify Access ", "vendor": "IBM", "versions": [{"status": "affected", "version": "10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, 10.0.4.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576."}], "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "644 Improper Neutralization of HTTP Headers for Scripting Syntax", "lang": "en"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2023-02-17T16:22:46.450Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/6953617"}, {"tags": ["vdb-entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Security Verify Access HOST header injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:14:28.496Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.ibm.com/support/pages/node/6953617"}, {"tags": ["vdb-entry", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-12T20:07:40.499885Z", "id": "CVE-2022-36775", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T20:07:43.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.ibm.com/support/pages/node/6953617", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576", "tags": ["vdb-entry", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:14:28.496Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-36775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-12T20:07:40.499885Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T20:07:33.298Z"}}], "cna": {"title": "IBM Security Verify Access HOST header injection", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "IBM", "product": "Security Verify Access ", "versions": [{"status": "affected", "version": "10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, 10.0.4.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/6953617", "tags": ["vendor-advisory"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576.", "supportingMedia": [{"type": "text/html", "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "644 Improper Neutralization of HTTP Headers for Scripting Syntax"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2023-02-17T16:22:46.450Z"}}}, "cveMetadata": {"cveId": "CVE-2022-36775", "state": "PUBLISHED", "dateUpdated": "2025-03-12T20:07:43.499Z", "dateReserved": "2022-07-26T14:04:17.547Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2023-02-17T16:22:46.450Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C73F59EB-1DCF-40E6-8E74-411F2E24527A", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "5D01451C-DAEF-4F0A-86CE-5EE40E3DE073", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "7E5E050F-CF03-471E-9611-37711C9FA446", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "7763712B-5716-434D-AA59-02102F8A25D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access:10.0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "5DC8EAED-20A4-4A09-BB5F-60ABE3938EF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "FD986F9E-F28D-431F-A038-54E2E7CD4E31", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BE19CE57-7453-4CDA-B85B-DD16296C2C17", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "50C3BD53-FDEE-4C59-ABC3-4B40CA35C32E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "B23D4DE5-CA3C-4BBA-9DC2-F322D210470B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:security_verify_access_docker:10.0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "39439FD4-A91F-473A-8FF8-BE48C51BCC32", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 233576."}, {"lang": "es", "value": "IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0 y 10.0.4.0 es vulnerable a la inyecci\u00f3n de encabezados HTTP, causada por una validaci\u00f3n incorrecta de la entrada por parte de los encabezados HOST. Esto podr\u00eda permitir a un atacante realizar varios ataques contra el sistema vulnerable, incluyendo cross-site scripting, envenenamiento de cach\u00e9 o secuestro de sesi\u00f3n. ID de IBM X-Force: 233576."}], "id": "CVE-2022-36775", "lastModified": "2024-11-21T07:13:40.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-17T17:15:11.137", "references": [{"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576"}, {"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6953617"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/233576"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/6953617"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}