Lucene search

IBMD56E6FD66F06197FCB0C5161D8AF8531F984F39D06EC4AF1689BEDA3D4C95F8A

HistoryMay 12, 2022 - 7:54 p.m.

Security Bulletin: IBM MQ for HP NonStop Server is affected by vulnerability CVE-2022-22325

2022-05-1219:54:35

www.ibm.com

ibm mq

hpe nonstop

vulnerability disclosure

plaintext password

stack trace

fixpack 8.1.0.10

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

5.1%

JSON

Summary

A queue manager trace may disclose a plaintext password flowing over an MQ channel. The issue is described by CVE-2022-22325

Vulnerability Details

CVEID:CVE-2022-22325
**DESCRIPTION:**IBM MQ can inadvertently disclose sensitive information under certain circumstances to a local user from a stack trace.
CVSS Base score: 5.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218853 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ for HPE NonStop	8.1.0

Remediation/Fixes

IBM MQ V8.1 for HPE NonStop	8.1.0.10	IT40789	Upgrade to Fixpack 8.1.0.10

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmq_for_hpe_nonstopMatch8.1

VendorProductVersionCPE
ibmmq_for_hpe_nonstop8.1cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_for_hpe_nonstop	8.1	cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1:::::::*

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

5.1%

JSON

Related for D56E6FD66F06197FCB0C5161D8AF8531F984F39D06EC4AF1689BEDA3D4C95F8A