CVE-2019-4552

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-15 · updated 2026-06-17

Description

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 165960.

Affected products

IBM Security Access Manager: from 9.0.7.0 before 9.0.7.2 — fixed in 9.0.7.2
IBM Security Verify Access: from 10.0.0 before 10.0.0.1 — fixed in 10.0.0.1

How to fix

Upgrade to a fixed version: IBM Security Access Manager 9.0.7.2; IBM Security Verify Access 10.0.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-4552 or the next vulnerability affects your stack