Lucene search

IBM548839014897FEBA98E9EFAD34639DAC1D15A0BFAE43177773A0B7779A57F0A5

HistorySep 05, 2024 - 9:24 p.m.

Security Bulletin: IBM MQ Appliance vulnerable to bypassing security restrictions (CVE-2024-40681)

2024-09-0521:24:02

www.ibm.com

ibm mq appliance

security bypass

vulnerability

apar it46501

fix pack

version 9.3 lts

version 9.3 cd

version 9.4 lts

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

Summary

IBM MQ Appliance has addressed a security bypass vulnerablity.

Vulnerability Details

CVEID:CVE-2024-40681
**DESCRIPTION:**IBM MQ could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297613 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ Appliance	9.3 LTS
IBM MQ Appliance	9.3 CD
IBM MQ Appliance	9.4 LTS

Remediation/Fixes

This vulnerability is addressed under APAR IT46501

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance fix pack 9.3.0.21, or later firmware.

IBM MQ Appliance version 9.3 CD

Upgrade to IBM MQ Appliance fix pack 9.4.0.5, or later firmware.

IBM MQ Appliance version 9.4 LTS

Apply IBM MQ Appliance fix pack 9.4.0.5, or later firmware.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmq_applianceMatch9.3.0.0

ibmmq_applianceMatch9.3.0.

ibmmq_applianceMatch9.3.0.1

ibmmq_applianceMatch9.3.0.2

ibmmq_applianceMatch9.3.0.3

ibmmq_applianceMatch9.3.0.4

ibmmq_applianceMatch9.3.0.5

ibmmq_applianceMatch9.3.0.6

ibmmq_applianceMatch9.3.0.10

ibmmq_applianceMatch9.3.0.11

ibmmq_applianceMatch9.3.0.15

ibmmq_applianceMatch9.3.0.16

ibmmq_applianceMatch9.3.0.17

ibmmq_applianceMatch9.3.0.20

ibmmq_applianceMatch9.3.1.0

ibmmq_applianceMatch9.3.1.1

ibmmq_applianceMatch9.3.2.0

ibmmq_applianceMatch9.3.2.1

ibmmq_applianceMatch9.3.3.0

ibmmq_applianceMatch9.3.3.1

ibmmq_applianceMatch9.3.4.0

ibmmq_applianceMatch9.3.4.1

ibmmq_applianceMatch9.3.5.0

ibmmq_applianceMatch9.3.5.1

ibmmq_applianceMatch9.3.5.2

ibmmq_applianceMatch9.4.0.0

VendorProductVersionCPE
ibmmq_appliance9.3.0.0cpe:2.3:a:ibm:mq_appliance:9.3.0.0:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.cpe:2.3:a:ibm:mq_appliance:9.3.0.:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.1cpe:2.3:a:ibm:mq_appliance:9.3.0.1:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.2cpe:2.3:a:ibm:mq_appliance:9.3.0.2:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.3cpe:2.3:a:ibm:mq_appliance:9.3.0.3:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.4cpe:2.3:a:ibm:mq_appliance:9.3.0.4:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.5cpe:2.3:a:ibm:mq_appliance:9.3.0.5:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.6cpe:2.3:a:ibm:mq_appliance:9.3.0.6:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.10cpe:2.3:a:ibm:mq_appliance:9.3.0.10:*:*:*:*:*:*:*
ibmmq_appliance9.3.0.11cpe:2.3:a:ibm:mq_appliance:9.3.0.11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_appliance	9.3.0.0	cpe:2.3:a:ibm:mq_appliance:9.3.0.0:::::::*
ibm	mq_appliance	9.3.0.	cpe:2.3:a:ibm:mq_appliance:9.3.0.:::::::*
ibm	mq_appliance	9.3.0.1	cpe:2.3:a:ibm:mq_appliance:9.3.0.1:::::::*
ibm	mq_appliance	9.3.0.2	cpe:2.3:a:ibm:mq_appliance:9.3.0.2:::::::*
ibm	mq_appliance	9.3.0.3	cpe:2.3:a:ibm:mq_appliance:9.3.0.3:::::::*
ibm	mq_appliance	9.3.0.4	cpe:2.3:a:ibm:mq_appliance:9.3.0.4:::::::*
ibm	mq_appliance	9.3.0.5	cpe:2.3:a:ibm:mq_appliance:9.3.0.5:::::::*
ibm	mq_appliance	9.3.0.6	cpe:2.3:a:ibm:mq_appliance:9.3.0.6:::::::*
ibm	mq_appliance	9.3.0.10	cpe:2.3:a:ibm:mq_appliance:9.3.0.10:::::::*
ibm	mq_appliance	9.3.0.11	cpe:2.3:a:ibm:mq_appliance:9.3.0.11:::::::*

Rows per page:

1-10 of 261

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

20.0%

JSON

Related for 548839014897FEBA98E9EFAD34639DAC1D15A0BFAE43177773A0B7779A57F0A5