CVE-2019-4461

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-25 · updated 2026-06-17
Weakness: CWE-74

Description

IBM Cloud Orchestrator 2.4 through 2.4.0.5 and 2.5 through 2.5.0.9 is vulnerable to HTTP Response Splitting caused by improper caching of content. This would allow the attacker to perform further attacks, such as Web Cache poisoning, cross-site scripting and possibly obtain sensitive information. IBM X-Force ID: 163682.

Affected products

IBM Cloud Orchestrator: from 2.4.0.0 through 2.4.0.5; from 2.5.0.0 through 2.5.0.9

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/163682
https://www.ibm.com/support/pages/node/1072684
https://exchange.xforce.ibmcloud.com/vulnerabilities/163682
https://www.ibm.com/support/pages/node/1072684

Get alerted when CVE-2019-4461 or the next vulnerability affects your stack