Lucene search

IbmCVELIST:CVE-2023-26284

HistoryMar 15, 2023 - 5:26 p.m.

CVE-2023-26284 IBM MQ Certified Container improper access controls

2023-03-1517:26:21

ibm

www.cve.org

ibm

container

access control

issue

x-force

248417

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls. IBM X-Force ID: 248417.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MQ Certified Container",
    "vendor": "IBM",
    "versions": [
      {
        "lessThan": "9.3.0.3",
        "status": "affected",
        "version": "9.3.0.1",
        "versionType": "semver"
      },
      {
        "lessThan": "9.3.1.1",
        "status": "affected",
        "version": "9.3.1.0",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/248417

www.ibm.com/support/pages/node/6960201

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

32.6%

JSON

Related for CVELIST:CVE-2023-26284