IBM444A3BC1F5D191701575F69C5EFF79C7F1910D68E0F3A8D82AC22DECD6A0E2C9Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-42252
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
64.9%
Summary
IBM UrbanCode Build is affected by CVE-2022-42252
Vulnerability Details
CVEID:CVE-2022-42252
**DESCRIPTION:**Apache Tomcat is vulnerable to HTTP request smuggling, caused by the failure to reject a request containing an invalid Content-Length header when configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false. By sending a specially-crafted request, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.
CVSS Base score: 4.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239171 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM UrbanCode Build | 6.1.4.0-6.1.7.6 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading to IBM UrbanCode Build version 6.1.7.7 or above.
| Affected Supporting Product(s) | Remediation/Fix |
|---|---|
| IBM UrbanCode Build 6.1.4.0 - 6.1.7.6 | Download IBM UrbanCode Build 6.1.7.7 – Includes Tomcat 8.5.84 |
Workarounds and Mitigations
None
Affected configurations
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
64.9%