Improper authorization in IBM Supplied MQ Advanced Queue Manager Container images



Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-26284
CWE-ID CWE-285
Exploitation vector Network
Public exploit N/A
Vulnerable software
 IBM Supplied MQ Advanced Queue Manager Container images
Server applications / Virtualization software

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Improper Authorization

EUVDB-ID: #VU72885

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-26284

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to improper authorization. All users authenticated with the cluster are granted administration access to the MQ Console, without checking IAM access rights.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

IBM Supplied MQ Advanced Queue Manager Container images: before 9.3.0.4-r1

CPE2.3 External links

https://www.ibm.com/support/pages/node/6960201


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###