Medium severity · published Jul 2, 2016
CVE-2016-0400
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to…
6.1
CVSS
2.1%
EPSS
No
On KEV
Description
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Websphere Extreme Scale · Ibm
7.1.0; 7.1.0.2; 7.1.1; 8.5.0; 8.5.0.1; 8.5.0.2; +8 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0400
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1PI60897
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1PI60898
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21983036
www.exploit-db.com
https://www.exploit-db.com/exploits/40039/
More from Websphere Extreme Scale
10.0
CVE-2026-13773
IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
9.9
CVE-2026-13772
IBM WebSphere eXtreme Scale's OQL is affected by remote code execution
8.8
CVE-2026-13759
IBM WebSphere eXtreme Scale is affected by Insecure Deserilization
6.5
CVE-2026-9002
IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled
6.1
CVE-2019-4109
IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim