Vulnerability Database

290,020

Total vulnerabilities in the database

CVE-2021-38944

IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 211236.

  • Published: May 18, 2022
  • Updated: Apr 14, 2023
  • CVE: CVE-2021-38944
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 6.1
  • AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
ibm / datapower_gateway 10.0.1.0 10.0.1.5.x
ibm / datapower_gateway 2018.4.1.0 2018.4.1.18.x
ibm / datapower_gateway 10.0.2.0 10.0.3.0.x