description: IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of content. This would allow the attacker to perform further attacks, such as Web Cache poisoning, cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 163682.
problem types: Gain Access
affected:
{
product: Cloud Orchestrator
vendor: IBM
versions:
status: affected, version: 2.4
status: affected, version: 2.4.0.1
status: affected, version: 2.4.0.2
status: affected, version: 2.5
status: affected, version: 2.5.0.1
status: affected, version: 2.4.0.3
status: affected, version: 2.5.0.2
status: affected, version: 2.4.0.4
status: affected, version: 2.5.0.3
status: affected, version: 2.5.0.4
status: affected, version: 2.4.0.5
status: affected, version: 2.5.0.5
status: affected, version: 2.5.0.6
status: affected, version: 2.5.0.7
status: affected, version: 2.5.0.8
status: affected, version: 2.5.0.9
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 4.7
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/I:L/PR:L/S:C/C:L/A:N/UI:R/E:U/RL:O/RC:C
version: 3.0
]