CVE-2024-51454 is an HTTP header injection vulnerability in IBM Engineering Workflow Management affecting versions 7.0.2, 7.0.3, and 7.1. The root cause is improper neutralization of HTTP headers for scripting syntax, specifically due to insufficient validation of HOST headers. This flaw could allow attackers to exploit the system by injecting malicious content into HTTP headers, potentially leading to cross-site scripting, cache poisoning, or session hijacking attacks. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact.

Successful exploitation could allow an attacker to conduct cross-site scripting, cache poisoning, or session hijacking against affected IBM Engineering Workflow Management systems. The confidentiality and integrity of data could be partially compromised, but availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or interim fix is explicitly stated as resolving this issue, users should monitor IBM advisories for updates. Until a patch is available, consider restricting or validating HOST header inputs at network or application layers if feasible.