What’s Vulnerable › Vulnerabilities

CVE-2022-37953: WorkstationST - Response Splitting in AM Gateway Challenge-Response

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-25 · updated 2026-06-17
• Weakness: CWE-113

Description

An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.

Affected products

• GE Gas Power WorkstationST: before 07.09.15 — fixed in 07.09.15

How to fix

Upgrade to a fixed version: GE Gas Power WorkstationST 07.09.15. Check the vendor advisory for mitigations.

References

• https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Response_Splitting.pdf
• https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-08-23_WorkstationST_Response_Splitting.pdf

Get alerted when CVE-2022-37953 or the next vulnerability affects your stack