Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| IBM | DevOps Plan | affected |
|
No data.
No data.
No data available yet.
Vendor Solution
To mitigate the issue please upgrade to IBM DevOps Plan v3.0.7 https://www.ibm.com/support/pages/devops-plan-307
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7275005 |
|
Thu, 11 Jun 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 11 Jun 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking | |
| Title | A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests. | |
| First Time appeared |
Ibm
Ibm devops Plan |
|
| Weaknesses | CWE-644 | |
| CPEs | cpe:2.3:a:ibm:devops_plan:3.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:devops_plan:3.0.6:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm devops Plan |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: ibm
Published:
Updated: 2026-06-11T16:52:52.339Z
Reserved: 2026-03-12T23:16:12.318Z
Link: CVE-2026-4096
Vulnrichment
Updated: 2026-06-11T16:25:55.376Z
NVD
Status : Received
Published: 2026-06-11T16:16:24.140
Modified: 2026-06-11T16:16:24.140
Link: CVE-2026-4096
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-644
Improper Neutralization of HTTP Headers for Scripting Syntax