Security Bulletin: IBM MQ can be incorrectly configured to prevent required authorization checks (CVE-2022-22316)

Summary

An issue was identified within the IBM MQ queue manager logic that meant improper authorization checks were performed when incorrect settings were configured for IBM MQ Clustering.

Vulnerability Details

CVEID:CVE-2022-22316
**DESCRIPTION:**IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to incorrectly configured authorization checks. IBM X-Force ID: 218276.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218276 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Remediation/Fixes

This issue was resolved under APAR IT39558

IBM MQ version 8

Apply the Cumulative Security Update 2 patch for IBM MQ version 8.0.0.16

IBM MQ version 9

Apply FixPack 9.0.0.13

IBM MQ version 9.1 LTS

Apply FixPack 9.1.0.11

IBM MQ version 9.2 LTS

Apply FixPack 9.2.0.5

IBM MQ version 9.1 CD and version 9.2 CD

Upgrade to IBM MQ version 9.2.5 CD

Workarounds and Mitigations

None