Medium severity · published Mar 7, 2025
CVE-2023-35894
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Sterling Control Center · Ibm
6.2.1; 6.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-35894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-35894
Vendor Advisory
https://www.ibm.com/support/pages/node/7185101
More from Sterling Control Center
5.4
CVE-2023-42007
IBM Sterling Control Center cross-site scripting
5.3
CVE-2023-35020
IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system
5.1
CVE-2016-0252
IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors
3.3
CVE-2023-43035
IBM Sterling Control Center information disclosure
–
CVE-2014-0925
Open redirect vulnerability in IBM Sterling Control Center 5.4.0 before 5.4.0.1 iFix 3 and 5.4.1 before 5.4.1.0 iFix 2 allows remote authenticated users to redirect users to…