Lucene search

IbmCVE-2024-39742

HistoryJul 08, 2024 - 2:15 p.m.

CVE-2024-39742

2024-07-0814:15:02

CWE-697

CWE-187

ibm

web.nvd.nist.gov

ibm

mq operator

authentication bypass

vulnerability

version 3.2.2

version 2.0.24

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

ibmmq_operatorRange2.0.0–2.0.24

ibmmq_operatorRange2.2.0–2.2.2

ibmmq_operatorRange2.3.0–2.3.3

ibmmq_operatorRange2.4.0–2.4.8

ibmmq_operatorRange3.1.0–3.1.3

ibmmq_operatorRange3.2.0–3.2.2

ibmmq_operatorMatch3.0.0

ibmmq_operatorMatch3.0.1

VendorProductVersionCPE
ibmmq_operator*cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*
ibmmq_operator3.0.0cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:*:*:*:*
ibmmq_operator3.0.1cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_operator	*	cpe:2.3:a:ibm:mq_operator::::::::
ibm	mq_operator	3.0.0	cpe:2.3:a:ibm:mq_operator:3.0.0:::::::*
ibm	mq_operator	3.0.1	cpe:2.3:a:ibm:mq_operator:3.0.1:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MQ Operator",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.24, 3.2.2"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/297169

www.ibm.com/support/pages/node/7159714

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

Related for CVE-2024-39742