Description IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
A host header injection vulnerability has been identified in IBM Engineering Workflow Management versions 7.0.2 prior to 7.0.2 Interim Fix 035, 7.0.3 prior to 7.0.3 Interim Fix 017, and 7.1 prior to 7.1 Interim Fix 004. This vulnerability arises from improper validation of input in the HOST headers, allowing attackers to inject malicious HTTP headers. Exploitation of this vulnerability could lead to various attacks, including cross-site scripting, cache poisoning, or session hijacking.
Users can upgrade to IBM Engineering Workflow Management 7.0.2 iFix036, 7.0.3 iFix018, or 7.1 iFix005. Instructions for downloading these fixes are available on the IBM Support Fix Central website.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026 Exploitation: NoneAutomatable: YesTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions ibm engineering workflow management 7.0.2
7.0.2 -
7.0.2 ifix001
7.0.2 ifix002
7.0.2 ifix003
7.0.2 ifix004
7.0.2 ifix005
7.0.2 ifix006
7.0.2 ifix007
7.0.2 ifix008a
7.0.2 ifix009
7.0.2 ifix010
7.0.2 ifix011
7.0.2 ifix012
7.0.2 ifix013
7.0.2 ifix014
7.0.2 ifix016
7.0.2 ifix017
7.0.2 ifix018
7.0.2 ifix020a
7.0.2 ifix021
7.0.2 ifix022
7.0.2 ifix023
7.0.2 ifix024
7.0.2 ifix025
7.0.2 ifix026a
7.0.2 ifix027
7.0.2 ifix028
7.0.2 ifix029
7.0.2 ifix030
7.0.2 ifix031
7.0.2 ifix032
7.0.2 ifix033
7.0.2 ifix034
7.0.2 ifix035
7.0.3 -
7.0.3 ifix001
7.0.3 ifix002
7.0.3 ifix003
7.0.3 ifix004
7.0.3 ifix005
7.0.3 ifix006
7.0.3 ifix007
7.0.3 ifix008
7.0.3 ifix009
7.0.3 ifix010
7.0.3 ifix011
7.0.3 ifix012
7.0.3 ifix013
7.0.3 ifix014
7.0.3 ifix015
7.0.3 ifix016
7.0.3 ifix017
7.1.0 -
7.1.0 ifix001
7.1.0 ifix002
7.1.0 ifix003
7.1.0 ifix004
7.1.0 ifix007
Viewing 5 of 59 versions. View all CPE cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:-:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix001:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix002:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix003:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix004:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix005:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix006:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix007:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix008a:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix009:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix010:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix011:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix012:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix013:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix014:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix016:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix017:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix018:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix020a:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix021:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix022:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix023:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix024:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix025:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix026a:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix027:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix028:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix029:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix030:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix031:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix032:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix033:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix034:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.2:ifix035:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:-:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix001:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix002:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix003:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix004:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix005:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix006:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix007:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix008:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix009:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix010:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix011:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix012:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix013:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix014:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix015:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix016:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.0.3:ifix017:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:-:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix001:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix002:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix003:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix004:*:*:*:*:*:* cpe:2.3:a:ibm:engineering_workflow_management:7.1.0:ifix007:*:*:*:*:*:* Remediation No remediation found in references.
Change History 3 change records found show changes