Lucene search

IBMFB06914A6536FA4CADA5C52E8322DB9EA10AE6B88CB944952885554BA8D18F9F

HistoryFeb 10, 2023 - 12:09 p.m.

Security Bulletin: IBM MQ Appliance is vulnerable to cross-site scripting (CVE-2022-32750)

2023-02-1012:09:25

www.ibm.com

ibm mq appliance

cross-site scripting

vulnerability

version 9.3 lts

version 9.2 cd

version 9.2 lts

security update

ibm x-force id

it41682

fixpack

cumulative security update

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.6%

JSON

Summary

IBM MQ Appliance has resolved a cross-site scripting vulnerability.

Vulnerability Details

CVEID:CVE-2022-32750
**DESCRIPTION:**IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228435.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228435 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM MQ Appliance	9.3 LTS
IBM MQ Appliance	9.2 CD
IBM MQ Appliance	9.2 LTS
IBM MQ Appliance	9.3 CD

Remediation/Fixes

This vulnerability is addressed under IT41682

IBM strongly recommends addressing the vulnerability now.

IBM MQ Appliance version 9.2 LTS

Apply 9.2.0.6 interim fix firmware for APAR IT41682, or later firmware.

IBM MQ Appliance version 9.2 CD

Upgrade to 9.2.5-CSU02, or later firmware.

IBM MQ Appliance version 9.3 LTS

Apply IBM MQ Appliance 9.3.0.2 fixpack, or later firmware.

IBM MQ Appliance version 9.3 CD

Apply IBM MQ Appliance 9.3.1.1 cumulative security update, or later firmware.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmq_applianceMatch9.2.0.0

ibmmq_applianceMatch9.2.0.1

ibmmq_applianceMatch9.2.0.2

ibmmq_applianceMatch9.2.0.3

ibmmq_applianceMatch9.2.0.4

ibmmq_applianceMatch9.2.0.5

ibmmq_applianceMatch9.2.0.6

ibmmq_applianceMatch9.2.1

ibmmq_applianceMatch9.2.2

ibmmq_applianceMatch9.2.3

ibmmq_applianceMatch9.2.4

ibmmq_applianceMatch9.2.5

ibmmq_applianceMatch01

ibmmq_applianceMatch9.3.0.0

VendorProductVersionCPE
ibmmq_appliance9.2.0.0cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.1cpe:2.3:a:ibm:mq_appliance:9.2.0.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.2cpe:2.3:a:ibm:mq_appliance:9.2.0.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.3cpe:2.3:a:ibm:mq_appliance:9.2.0.3:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.4cpe:2.3:a:ibm:mq_appliance:9.2.0.4:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.5cpe:2.3:a:ibm:mq_appliance:9.2.0.5:*:*:*:*:*:*:*
ibmmq_appliance9.2.0.6cpe:2.3:a:ibm:mq_appliance:9.2.0.6:*:*:*:*:*:*:*
ibmmq_appliance9.2.1cpe:2.3:a:ibm:mq_appliance:9.2.1:*:*:*:*:*:*:*
ibmmq_appliance9.2.2cpe:2.3:a:ibm:mq_appliance:9.2.2:*:*:*:*:*:*:*
ibmmq_appliance9.2.3cpe:2.3:a:ibm:mq_appliance:9.2.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	mq_appliance	9.2.0.0	cpe:2.3:a:ibm:mq_appliance:9.2.0.0:::::::*
ibm	mq_appliance	9.2.0.1	cpe:2.3:a:ibm:mq_appliance:9.2.0.1:::::::*
ibm	mq_appliance	9.2.0.2	cpe:2.3:a:ibm:mq_appliance:9.2.0.2:::::::*
ibm	mq_appliance	9.2.0.3	cpe:2.3:a:ibm:mq_appliance:9.2.0.3:::::::*
ibm	mq_appliance	9.2.0.4	cpe:2.3:a:ibm:mq_appliance:9.2.0.4:::::::*
ibm	mq_appliance	9.2.0.5	cpe:2.3:a:ibm:mq_appliance:9.2.0.5:::::::*
ibm	mq_appliance	9.2.0.6	cpe:2.3:a:ibm:mq_appliance:9.2.0.6:::::::*
ibm	mq_appliance	9.2.1	cpe:2.3:a:ibm:mq_appliance:9.2.1:::::::*
ibm	mq_appliance	9.2.2	cpe:2.3:a:ibm:mq_appliance:9.2.2:::::::*
ibm	mq_appliance	9.2.3	cpe:2.3:a:ibm:mq_appliance:9.2.3:::::::*

Rows per page:

1-10 of 141