Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2021-38910)

Summary

IBM MQ Appliance has resolved an improper validation vulnerability.

Vulnerability Details

CVEID:CVE-2021-38910
**DESCRIPTION:**IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input. By sending a specially crafted JSON message, an attacker could exploit this vulnerability to modify structure and fields. IBM X-Force ID: 209824.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/209824 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

This vulnerability is addressed under IT40352

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.6 fixpack, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5 CD CSU01, or later firmware.

Workarounds and Mitigations

None