Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveIbmCVE-2019-4294
HistoryAug 20, 2019 - 7:15 p.m.

CVE-2019-4294

2019-08-2019:15:11
CWE-78
ibm
web.nvd.nist.gov
26
ibm
datapower gateway
ibm mq appliance
cve-2019-4294
command injection
vulnerability
x-force id 16188

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0

Percentile

9.8%

JSON

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection vulnerability. IBM X-Force ID: 16188.

Affected configurations

Nvd
Vulners
Node
ibmdatapower_gatewayRange<2018.4.1.7continuous_delivery
OR
ibmdatapower_gatewayRange7.6.0.0–7.6.0.15
OR
ibmdatapower_gatewayRange2018.4.1.0–2018.4.1.6
OR
ibmmq_applianceRange8.0.0.0–8.0.0.12
OR
ibmmq_applianceRange9.1.0.0–9.1.0.2lts
OR
ibmmq_applianceRange9.1.1–9.1.2continuous_delivery
VendorProductVersionCPE
ibmdatapower_gateway*cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:continuous_delivery:*:*:*
ibmdatapower_gateway*cpe:2.3:a:ibm:datapower_gateway:*:*:*:*:*:*:*:*
ibmmq_appliance*cpe:2.3:a:ibm:mq_appliance:*:*:*:*:*:*:*:*
ibmmq_appliance*cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:*
ibmmq_appliance*cpe:2.3:a:ibm:mq_appliance:*:*:*:*:continuous_delivery:*:*:*

CNA Affected

[
  {
    "product": "MQ Appliance",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.0.0.3"
      },
      {
        "status": "affected",
        "version": "8.0.0.4"
      },
      {
        "status": "affected",
        "version": "8.0.0.5"
      },
      {
        "status": "affected",
        "version": "8.0.0.6"
      },
      {
        "status": "affected",
        "version": "8.0.0.0"
      },
      {
        "status": "affected",
        "version": "8.0.0.8"
      },
      {
        "status": "affected",
        "version": "8.0.0.10"
      },
      {
        "status": "affected",
        "version": "9.1.0.0"
      },
      {
        "status": "affected",
        "version": "8.0.0.11"
      },
      {
        "status": "affected",
        "version": "9.1.0.1"
      },
      {
        "status": "affected",
        "version": "9.1.1"
      },
      {
        "status": "affected",
        "version": "8.0.0.1"
      },
      {
        "status": "affected",
        "version": "8.0.0.7"
      },
      {
        "status": "affected",
        "version": "8.0.0.9"
      },
      {
        "status": "affected",
        "version": "8.0.0.2"
      },
      {
        "status": "affected",
        "version": "8.0.0.12"
      },
      {
        "status": "affected",
        "version": "9.1.0.2"
      },
      {
        "status": "affected",
        "version": "9.1.2"
      }
    ]
  },
  {
    "product": "DataPower Gateway",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.6.0.0"
      },
      {
        "status": "affected",
        "version": "2018.4.1.0"
      },
      {
        "status": "affected",
        "version": "2018.4.1.6"
      },
      {
        "status": "affected",
        "version": "7.6.0.15"
      },
      {
        "status": "affected",
        "version": "CD"
      }
    ]
  }
]

Related

ibm 2
nvd 1
prion 1
cvelist 1
ibm
ibm
Security Bulletin: IBM MQ Appliance is affected by a command injection vulnerability (CVE-2019-4294)
2019-08-14 11:14:13
Security Bulletin: IBM DataPower Gateway is affected by an injection vulnerability (CVE-2019-4294)
2021-06-08 21:47:38
nvd
nvd
CVE-2019-4294
2019-08-20 19:15:11
prion
prion
Command injection
2019-08-20 19:15:00
cvelist
cvelist
CVE-2019-4294
2019-08-20 18:25:26

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0

Percentile

9.8%

JSON
Related for CVE-2019-4294
ibm2nvd1prion1cvelist1