CVE-2017-1503

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 129578.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	IBM WebSphere Application Server	7.0, 8.0, 8.5, 9.0

References

http://www-01.ibm.com/support/docview.wss?uid=swg22006815Vendor Advisory
http://www.securityfocus.com/bid/101234Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039521Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/129578VDB Entry, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg22006815Vendor Advisory
http://www.securityfocus.com/bid/101234Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039521Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/129578VDB Entry, Vendor Advisory

Timeline

Published: Oct 10, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-150306.1Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-150317.5In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure CVE-2017-150329.8ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.CVE-2017-150337.5ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.CVE-2017-150357.5EmTec PyroBatchFTP before 3.18 allows remote servers to cause a denial of service (application crash).CVE-2017-150378.1In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, becaus CVE-2017-150385.6Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive i CVE-2017-150394.8Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default CVE-2017-15046.5IBM WebSphere Application Server version 9.0.0.4 could provide weaker than expected security after using the PasswordUtil command to enable CVE-2017-150419.8Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so t CVE-2017-150425.9An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme m CVE-2017-150438.8A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X,