Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM427441453812D962F815F1BF7FA05603925C6A824DB38691530C7A828432F1A2
HistoryFeb 10, 2023 - 12:38 p.m.

Security Bulletin: IBM MQ Appliance is vulnerable to an XML External Entity Injection attack (CVE-2022-31775)

2023-02-1012:38:18
www.ibm.com
33
ibm mq appliance
xml external entity injection
it41682
versions affected

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.002

Percentile

52.0%

JSON

Summary

IBM MQ Appliance has resolved an XML External Entity Injection vulnerability.

Vulnerability Details

CVEID:CVE-2022-31775
**DESCRIPTION:**IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228359 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM MQ Appliance 9.3 LTS
IBM MQ Appliance 9.2 CD
IBM MQ Appliance 9.2 LTS
IBM MQ Appliance 9.3 CD

Remediation/Fixes

This vulnerability is addressed under IT41682

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.6 interim fix firmware for APAR IT41682, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5-CSU02, or later firmware.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance 9.3.0.2 fixpack, or later firmware.

IBM MQ Appliance version 9.3 CD

Apply IBM MQ Appliance 9.3.1.1 cumulative security update, or later firmware.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmq_applianceMatch9.2.0.0
OR
ibmmq_applianceMatch9.2.0.1
OR
ibmmq_applianceMatch9.2.0.2
OR
ibmmq_applianceMatch9.2.0.3
OR
ibmmq_applianceMatch9.2.0.4
OR
ibmmq_applianceMatch9.2.0.5
OR
ibmmq_applianceMatch9.2.0.6
OR
ibmmq_applianceMatch9.2.1
OR
ibmmq_applianceMatch9.2.2
OR
ibmmq_applianceMatch9.2.3
OR
ibmmq_applianceMatch9.2.4
OR
ibmmq_applianceMatch9.2.5
OR
ibmmq_applianceMatch9.2.5
OR
ibmmq_applianceMatch01
OR
ibmmq_applianceMatch9.3.0.0
VendorProductVersionCPE
ibmmq_appliance9.2.0.0cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.1cpe:2.3:a:ibm:mq_appliance:9.2.0.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.2cpe:2.3:a:ibm:mq_appliance:9.2.0.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.3cpe:2.3:a:ibm:mq_appliance:9.2.0.3:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.4cpe:2.3:a:ibm:mq_appliance:9.2.0.4:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.5cpe:2.3:a:ibm:mq_appliance:9.2.0.5:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.6cpe:2.3:a:ibm:mq_appliance:9.2.0.6:*:*:*:*:*:*:*
ibmmq_appliance9.2.1cpe:2.3:a:ibm:mq_appliance:9.2.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.2cpe:2.3:a:ibm:mq_appliance:9.2.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.3cpe:2.3:a:ibm:mq_appliance:9.2.3:*:*:*:*:*:*:*
Rows per page:
1-10 of 141

Related

ibm 1
nvd 1
cnvd 1
cvelist 1
prion 1
cve 1
ibm
ibm
Security Bulletin: IBM DataPower Gateway vulnerable to XML Entity Expansion attack in Web UI (CVE-2022-31775)
2024-08-08 15:15:58
nvd
nvd
CVE-2022-31775
2022-08-01 11:15:13
cnvd
cnvd
IBM DataPower Gateway XML External Entity Injection Vulnerability (CNVD-2022-56970)
2022-08-04 00:00:00
cvelist
cvelist
CVE-2022-31775
2022-07-31 16:06:37
prion
prion
Xxe
2022-08-01 11:15:00
cve
cve
CVE-2022-31775
2022-08-01 11:15:13

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

0.002

Percentile

52.0%

JSON
Related for 427441453812D962F815F1BF7FA05603925C6A824DB38691530C7A828432F1A2
ibm1nvd1cnvd1cvelist1prion1cve1