Vulnerability · Published Jun 22, 2026 · Assigned by ibm

CVE-2024-51454IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed

Medium 6.5

In plain English

A medium-severity security flaw in Engineering Workflow Management from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

Affected products (as reported)

Vendor	Product	Versions
IBM	Engineering Workflow Management	7.0.2 – through 7.0.2 Interim Fix 0357.0.3 – through 7.0.3 Interim Fix 0177.1 – through 7.1 Interim Fix 004

Weakness: CWE-644 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://www.ibm.com/support/pages/node/7276371 vendor-advisory, patch