CVE-2022-22399

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 222562.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/222562	Vendor Advisory
https://www.ibm.com/support/pages/node/6618959	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/222562	Vendor Advisory
https://www.ibm.com/support/pages/node/6618959	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:aspera_faspex:5.0.0:::::::*
	cpe:2.3:a:ibm:aspera_faspex:5.0.1:::::::*

History

14 Jan 2025, 20:30

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/222562 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/222562 - Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/6618959 -~~	() https://www.ibm.com/support/pages/node/6618959 - Vendor Advisory
First Time		Ibm aspera Faspex Ibm
CWE		CWE-116
CPE		cpe:2.3:a:ibm:aspera_faspex:5.0.1:::::::* cpe:2.3:a:ibm:aspera_faspex:5.0.0:::::::*

Information

Published : 2024-03-05 20:16

Updated : 2025-01-14 20:30

NVD link : CVE-2022-22399

Mitre link : CVE-2022-22399

CVE.ORG link : CVE-2022-22399

JSON object : View

Products Affected

ibm

aspera_faspex

CWE

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2022-22399", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-03-05T20:16:00.620", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/222562", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6618959", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/222562", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/6618959", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-644"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 222562."}, {"lang": "es", "value": "IBM Aspera Faspex 5.0.0 y 5.0.1 es vulnerable a la inyecci\u00f3n de encabezados HTTP, causada por una validaci\u00f3n incorrecta de la entrada por parte de los encabezados HOST. Esto podr\u00eda permitir a un atacante realizar varios ataques contra el sistema vulnerable, incluido cross-site scripting, envenenamiento de cach\u00e9 o secuestro de sesi\u00f3n. ID de IBM X-Force: 222562."}], "lastModified": "2025-01-14T20:30:07.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:aspera_faspex:5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D544CB4-DA28-49C7-80B9-7CF162769725"}, {"criteria": "cpe:2.3:a:ibm:aspera_faspex:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "143B5F6D-C033-4012-AB0A-E3D47162CD93"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}