CVE-2021-29872

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-116

Description

IBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 206228.

Affected products

IBM Cloud Pak for Automation: before 21.0.2; before 21.0.1; 21.0.2, 21.0.2-interim_fix001, 21.0.2-interim_fix002, 21.0.2-interim_fix003, 21.0.2-interim_fix004, 21.0.2-interim_fix005 (+8) — fixed in 21.0.1, 21.0.2

How to fix

Upgrade to a fixed version: IBM Cloud Pak for Automation 21.0.1, 21.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-29872 or the next vulnerability affects your stack