CVE-2012-3294

2012-08-1710:31:52

CWE-352

[email protected]

web.nvd.nist.gov

cve-2012-3294

csrf

ibm

websphere

file transfer edition

cross site request forgery

vulnerabilities

security

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.4 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

75.3%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI, or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI.

Affected configurations

NVD

Node

ibmwebsphere_mqRange≤7.0.4file_transfer

ibmwebsphere_mqMatch7.0file_transfer

ibmwebsphere_mqMatch7.0.0.1file_transfer

ibmwebsphere_mqMatch7.0.1.0file_transfer

ibmwebsphere_mqMatch7.0.2.0file_transfer

ibmwebsphere_mqMatch7.0.2.2file_transfer

ibmwebsphere_mqMatch7.0.4.0file_transfer

ibmwebsphere_mq_managed_file_transferMatch7.5

CPENameOperatorVersion
ibm:websphere_mqibm websphere mqle7.0.4
ibm:websphere_mqibm websphere mqeq7.0
ibm:websphere_mqibm websphere mqeq7.0.0.1
ibm:websphere_mqibm websphere mqeq7.0.1.0
ibm:websphere_mqibm websphere mqeq7.0.2.0
ibm:websphere_mqibm websphere mqeq7.0.2.2
ibm:websphere_mqibm websphere mqeq7.0.4.0
ibm:websphere_mq_managed_file_transferibm websphere mq managed file transfereq7.5

CPE	Name	Operator	Version
ibm:websphere_mq	ibm websphere mq	le	7.0.4
ibm:websphere_mq	ibm websphere mq	eq	7.0
ibm:websphere_mq	ibm websphere mq	eq	7.0.0.1
ibm:websphere_mq	ibm websphere mq	eq	7.0.1.0
ibm:websphere_mq	ibm websphere mq	eq	7.0.2.0
ibm:websphere_mq	ibm websphere mq	eq	7.0.2.2
ibm:websphere_mq	ibm websphere mq	eq	7.0.4.0
ibm:websphere_mq_managed_file_transfer	ibm websphere mq managed file transfer	eq	7.5