Home

Description

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.

PUBLISHED Reserved 2025-03-29 | Published 2025-04-18 | Updated 2025-08-28 | Assigner ibm




MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Problem types

CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax

Product status

Default status
unaffected

7.3
affected

7.4
affected

7.5
affected

7.6
affected

References

www.ibm.com/support/pages/node/7231320 vendor-advisory patch

cve.org (CVE-2025-2950)

nvd.nist.gov (CVE-2025-2950)

Download JSON