IBM WebSphere Commerce CVE-2015-0196 HTTP Response Splitting Vulnerability

Bugtraq ID:	75344
Class:	Input Validation Error
CVE:	CVE-2015-0196
Remote:	Yes
Local:	No
Published:	Jun 22 2015 12:00AM
Updated:	Jun 22 2015 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	IBM WebSphere Commerce 7.0 8 IBM WebSphere Commerce 7.0 7 IBM WebSphere Commerce 7.0.0.6 IBM WebSphere Commerce 7.0.0.5 IBM WebSphere Commerce 7.0.0.4 IBM WebSphere Commerce 7.0.0.3 IBM WebSphere Commerce 7.0.0.2 IBM WebSphere Commerce 7.0.0.1 IBM WebSphere Commerce 6.0.0.9 IBM WebSphere Commerce 6.0.0.8 IBM WebSphere Commerce 6.0.0.7 IBM WebSphere Commerce 6.0.0.6 IBM WebSphere Commerce 6.0.0.5 IBM WebSphere Commerce 6.0.0.4 IBM WebSphere Commerce 6.0.0.3 IBM WebSphere Commerce 6.0.0.2 IBM WebSphere Commerce 6.0.0.11 IBM WebSphere Commerce 6.0.0.10 IBM WebSphere Commerce 6.0.0.1 IBM WebSphere Commerce 6.0.0.0
Not Vulnerable:

IBM WebSphere Commerce CVE-2015-0196 HTTP Response Splitting Vulnerability

IBM WebSphere Commerce is prone to an HTTP response-splitting vulnerability.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into having a false sense of trust.

IBM WebSphere Commerce CVE-2015-0196 HTTP Response Splitting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

IBM WebSphere Commerce CVE-2015-0196 HTTP Response Splitting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM WebSphere Commerce CVE-2015-0196 HTTP Response Splitting Vulnerability

References:

• IBM Homepage (IBM)
  
• WebSphere Commerce is vulnerable to a HTTP Response Splitting attack (CVE-2015-0 (IBM)