Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM67A7CD5F3C74A762D910D3C39E2832EA5034CFDD010BCB4F2C1032831C923971
HistoryMar 16, 2023 - 4:26 p.m.

Security Bulletin: IBM Sterling B2B Integrator vulnerable to sensitive information exposure due to IBM MQ (CVE-2022-42436)

2023-03-1616:26:43
www.ibm.com
33
ibm sterling b2b integrator
sensitive information exposure
ibm mq
cve-2022-42436
security vulnerability
updates
affected versions
ibm entitled registry
ibm sterling file gateway

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON

Summary

IBM Sterling B2B Integrator has addressed the security vulnerabilities in IBM MQ.

Vulnerability Details

CVEID:CVE-2022-42436
**DESCRIPTION:**IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. IBM X-Force ID: 238206.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238206 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Sterling B2B Integrator 6.0.0.0 - 6.0.3.7
IBM Sterling B2B Integrator 6.1.0.0 - 6.1.2.0

Remediation/Fixes

**Product ** Version APAR Remediation & Fix
IBM Sterling B2B Integrator 6.0.0.0 - 6.0.3.7 IT43073 Apply 6.0.3.8
IBM Sterling B2B Integrator 6.1.0.0 - 6.1.2.0 IT43073 Apply 6.1.2.1

The IIM versions of 6.0.3.8 and 6.1.2.1 are available on Fix Central.

The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsterling_b2b_integratorMatch6.0.0.0
OR
ibmsterling_b2b_integratorMatch6.1.2.2

Related

nvd 1
veracode 1
nessus 1
cvelist 1
prion 1
cve 1
ibm 3
nvd
nvd
CVE-2022-42436
2023-02-12 04:15:15
veracode
veracode
Information Disclosure
2023-02-21 11:32:10
nessus
nessus
IBM MQ Information Disclosure (6909467)
2023-02-08 00:00:00
cvelist
cvelist
CVE-2022-42436 IBM MQ information disclosure
2023-02-08 19:28:52
prion
prion
Design/Logic Flaw
2023-02-12 04:15:00
cve
cve
CVE-2022-42436
2023-02-12 04:15:15
ibm
ibm
Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use FTE nodes may be vulnerable to loss of confidentiality due to [CVE-2022-42436]
2023-04-28 11:42:04
Security Bulletin: IBM MQ Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. (CVE-2022-42436)
2023-02-02 12:42:45
Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a local user accessing sensitive information due to IBM MQ Managed File Transfer and Apache Commons Net (CVE-2021-37533, CVE-2022-42436, CVE-2022-43919)
2023-06-09 15:37:32

4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

5.1%

JSON
Related for 67A7CD5F3C74A762D910D3C39E2832EA5034CFDD010BCB4F2C1032831C923971
nvd1veracode1nessus1cvelist1prion1cve1ibm3