IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to HTTP header injection, caused by…

Description

IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 144884.

Scores

EPSS (exploitation in 30 days)

1.00% · top 37% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• Gain Access
• CWE-20 (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• IBM · Rational Collaborative Lifecycle Management

  • affected 5.0
  • affected 5.0.1
  • affected 5.0.2
  • affected 6.0
  • affected 6.0.1
  • affected 6.0.2
  • affected 6.0.3
  • affected 6.0.4
  • affected 6.0.5
  • affected 6.0.6

References (3)

• ibm-jazz-cve20181658-cache-poisoning(144884) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://www.ibm.com/support/docview.wss?uid=ibm10875340 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 107435 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-1658](https://trackcve.app/badge/CVE-2018-1658.svg)](https://trackcve.app/cve/CVE-2018-1658)

Record last updated 16 Sept 2024, 16:14 UTC.