Lucene search

IBM11F2A5C376E0F4FD6CCE3652272C2411F5100DE34D82E69A281E97CB4C38DB94

HistoryMay 25, 2022 - 9:23 a.m.

Security Bulletin: IBM MQ Appliance is affected by sensitive information disclosure vulnerability (CVE-2022-22325)

2022-05-2509:23:51

www.ibm.com

ibm mq

appliance

sensitive information disclosure

vulnerability

cve-2022-22325

resolved

security bulletin

affected products

versions

remediation

it40099

interim fix

firmaware

upgrade

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

5.1%

JSON

Summary

IBM MQ Appliance has resolved a sensitive information disclosure vulnerability.

Vulnerability Details

CVEID:CVE-2022-22325
**DESCRIPTION:**IBM MQ can inadvertently disclose sensitive information under certain circumstances to a local user from a stack trace.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218853 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ Appliance	9.2 CD
IBM MQ Appliance	9.2 LTS

Remediation/Fixes

This vulnerability is addressed under IT40099

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply interim fix firmware for APAR IT40099, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5 CD, or later firmware.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmq_applianceMatch9.2.0.0

ibmmq_applianceMatch9.2.0.1

ibmmq_applianceMatch9.2.0.2

ibmmq_applianceMatch9.2.0.3

ibmmq_applianceMatch9.2.0.4

ibmmq_applianceMatch9.2.0.5

ibmmq_applianceMatch9.2.1

ibmmq_applianceMatch9.2.2

ibmmq_applianceMatch9.2.3

ibmmq_applianceMatch9.2.4

VendorProductVersionCPE
ibmmq_appliance9.2.0.0cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.1cpe:2.3:a:ibm:mq_appliance:9.2.0.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.2cpe:2.3:a:ibm:mq_appliance:9.2.0.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.3cpe:2.3:a:ibm:mq_appliance:9.2.0.3:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.4cpe:2.3:a:ibm:mq_appliance:9.2.0.4:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.5cpe:2.3:a:ibm:mq_appliance:9.2.0.5:*:*:*:*:*:*:*
ibmmq_appliance9.2.1cpe:2.3:a:ibm:mq_appliance:9.2.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.2cpe:2.3:a:ibm:mq_appliance:9.2.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.3cpe:2.3:a:ibm:mq_appliance:9.2.3:*:*:*:*:*:*:*
ibmmq_appliance9.2.4cpe:2.3:a:ibm:mq_appliance:9.2.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_appliance	9.2.0.0	cpe:2.3:a:ibm:mq_appliance:9.2.0.0:::::::*
ibm	mq_appliance	9.2.0.1	cpe:2.3:a:ibm:mq_appliance:9.2.0.1:::::::*
ibm	mq_appliance	9.2.0.2	cpe:2.3:a:ibm:mq_appliance:9.2.0.2:::::::*
ibm	mq_appliance	9.2.0.3	cpe:2.3:a:ibm:mq_appliance:9.2.0.3:::::::*
ibm	mq_appliance	9.2.0.4	cpe:2.3:a:ibm:mq_appliance:9.2.0.4:::::::*
ibm	mq_appliance	9.2.0.5	cpe:2.3:a:ibm:mq_appliance:9.2.0.5:::::::*
ibm	mq_appliance	9.2.1	cpe:2.3:a:ibm:mq_appliance:9.2.1:::::::*
ibm	mq_appliance	9.2.2	cpe:2.3:a:ibm:mq_appliance:9.2.2:::::::*
ibm	mq_appliance	9.2.3	cpe:2.3:a:ibm:mq_appliance:9.2.3:::::::*
ibm	mq_appliance	9.2.4	cpe:2.3:a:ibm:mq_appliance:9.2.4:::::::*

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

5.1%

JSON

Related for 11F2A5C376E0F4FD6CCE3652272C2411F5100DE34D82E69A281E97CB4C38DB94