CVE-2023-47143 is an HTTP Host header injection in IBM TADDM 7.3.0.0 through 7.3.0.10. NVD scores it 10.0 Critical, while IBM's bulletin rates it 6.5. Both agree on the fix: install TADDM fix pack 7.3.0.11, and limit exposure of the web interface.
What's affected
IBM lists IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 as affected. The remediation is TADDM FixPack 7.3.0.11, also named 7.3-TIV-ITADDM-FP00011.
The severity differs between sources, and it matters. The NVD record scores this issue 10.0 Critical with a changed scope. IBM's bulletin gives a CVSS 3.0 base score of 6.5 with low confidentiality and integrity impact and no availability impact. The text from both says the same thing: improper validation of input from the HOST header could allow attacks such as cross-site scripting, cache poisoning or session hijacking. Treat the high NVD number as the conservative planning figure, and note that the vendor sees it as medium.
The same bulletin covers CVE-2023-47142, the API privilege escalation, and a cross-site scripting issue.
The NVD record was published on 2024-02-02, scores 10.0 (Critical), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Weakness class: CWE-644, CWE-116.
How to check if you're exposed
Confirm the TADDM version and who can reach it.
- Read the version from the product's administrative console or IBM's documented version command for your install.
- Compare with the affected range, 7.3.0.0 through 7.3.0.10.
- If a reverse proxy or load balancer sits in front, check whether it rewrites or validates the Host header.
If you can, verify that the proxy only forwards expected host names. That is a useful control whether or not you patch today.
What to do now
- Install TADDM fix pack 7.3.0.11 from IBM.
- Configure the proxy or web tier to accept only known host names for TADDM.
- Limit access to the TADDM web interface to administrators and management networks.
- Clear any cache in front of TADDM after patching.
- Record both severity ratings in your tracker so reviewers know why you chose a priority.
Why it matters
Applications often build links, redirects and cached pages from the Host header. If the value is not validated, an attacker can supply a different one and influence what the application returns. The record's weakness tags are CWE-644 and CWE-116, improper neutralization of HTTP headers and improper output encoding.
A 10.0 versus 6.5 gap usually comes from different assumptions about what an attacker reaches after the injection. The practical step is the same either way: patch, and validate host names at the edge. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Which score should I use?
Record both. NVD says 10.0 Critical and IBM says 6.5. Patching to fix pack 7.3.0.11 removes the question for this issue.
Sources
Last reviewed: 19 October 2026.
