CVE:CVE-2021-29872
CNNVD:CNNVD-202201-1532
IBM Cloud Pak for Automation是美国IBM公司的一个应用于云环境中用于构建自动化应用的智能软件平台。该平台使用预先集成的自动化技术和低代码工具，在任何云上设计、构建和运行自动化应用与服务。
IBM Cloud Pak for Automation 21.0.1 和 21.0.2 - Business Automation Studio 组件存在安全漏洞，该漏洞源于 HOST 标头的输入验证不当。远程攻击者可以利用此漏洞注入特制的 HTTP HOST 标头，从而对易受攻击的系统进行各种攻击，包括跨站点脚本、缓存中毒或会话劫持。
solution:Upgrade ibm cloud_pak_for_automation to a higher version than 21.0.2,21.0.2,21.0.2:interim_fix001,21.0.2:interim_fix002,21.0.2:interim_fix003,21.0.2:interim_fix004,21.0.2:interim_fix005,21.0.2:interim_fix006,21.0.1,21.0.1,21.0.1:interim_fix001,21.0.1:interim_fix002,21.0.1:interim_fix003,21.0.1:interim_fix004,21.0.1:interim_fix005,21.0.1:interim_fix006,and avoid the version (,21.0.2),21.0.2,21.0.2:interim_fix001,21.0.2:interim_fix002,21.0.2:interim_fix003,21.0.2:interim_fix004,21.0.2:interim_fix005,21.0.2:interim_fix006,(,21.0.1),21.0.1,21.0.1:interim_fix001,21.0.1:interim_fix002,21.0.1:interim_fix003,21.0.1:interim_fix004,21.0.1:interim_fix005,21.0.1:interim_fix006