IBM Engineering Workflow Management up to 7.0.2/7.0.3/7.1 HTTP Header http headers for scripting syntax

Summaryinfo

A vulnerability identified as critical has been detected in IBM Engineering Workflow Management up to 7.0.2/7.0.3/7.1. Affected by this issue is some unknown functionality of the component HTTP Header Handler. This manipulation causes improper neutralization of http headers for scripting syntax. This vulnerability appears as CVE-2024-51454. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in IBM Engineering Workflow Management up to 7.0.2/7.0.3/7.1 and classified as critical. Affected by this vulnerability is some unknown functionality of the component HTTP Header Handler. The manipulation with an unknown input leads to a improper neutralization of http headers for scripting syntax vulnerability. The CWE definition for the vulnerability is CWE-644. The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

It is possible to read the advisory at ibm.com. This vulnerability is known as CVE-2024-51454 since 10/28/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/23/2026).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-55644). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• Engineering Workflow Management

Version

• 7.0
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion