Skip to content
OpenAdvisories
Medium WID-SEC-2024-1466 5 CVEs

IBM MQ: Mehrere Schwachstellen

Published Jun 26, 2024 · Updated Jul 7, 2024 · Revision 2 · de-DE

Vendor: IBM Product: MQ Platform: Linux

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu erzeugen oder vertrauliche Informationen offenzulegen.

Product

IBM MQ ist eine Message Oriented Middleware von IBM.

Vulnerabilities 5

  • High 7.5
    CVE-2024-31912

    IBM MQ privilege escalation

    IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. IBM X-Force ID: 289894.

    IBM MQ
  • Medium 6.5
    CVE-2024-35155

    IBM MQ information disclosure

    IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Forc…

    IBM MQ
  • Medium 6.5
    CVE-2024-35156

    IBM MQ information disclosure

    IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292766.

    IBM MQ
  • Medium 5.9
    CVE-2024-31919

    IBM MQ denial of service

    IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service attack caused by an error processing messages when an API Exit using MQBUFMH is used. IBM X-Force ID: 290259.

    IBM MQ
  • Medium 5.9
    CVE-2024-35116

    IBM MQ denial of service

    IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes. IBM X-Force ID: 290335.

    IBM MQ

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References