Lucene search

IbmCVE-2024-40681

HistorySep 07, 2024 - 3:15 p.m.

CVE-2024-40681

2024-09-0715:15:10

CWE-266

ibm

web.nvd.nist.gov

ibm mq operator

security restrictions

authenticated user

queue manager

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

IBM MQ Operator 2.0.26 and 3.2.4 could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

Affected configurations

Vulners

Node

ibmmq_operatorMatch2.0.26

ibmmq_operatorMatch3.2.4

VendorProductVersionCPE
ibmmq_operator2.0.26cpe:2.3:a:ibm:mq_operator:2.0.26:*:*:*:*:*:*:*
ibmmq_operator3.2.4cpe:2.3:a:ibm:mq_operator:3.2.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_operator	2.0.26	cpe:2.3:a:ibm:mq_operator:2.0.26:::::::*
ibm	mq_operator	3.2.4	cpe:2.3:a:ibm:mq_operator:3.2.4:::::::*

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:mq_operator:2.0.6:*:*:*:-:*:*:*",
      "cpe:2.3:a:ibm:mq_operator:3.2.4:*:*:*:-:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "MQ Operator",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.26, 3.2.4"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/297611

www.ibm.com/support/pages/node/7167732

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

Related for CVE-2024-40681