PT-2014-7051 · Ibm · Websphere Mq

Publicado 2014-10-19 · Atualizado 2017-09-08 · CVE-2014-6116

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebSphere MQ version 8.0.0.1 before p000-001-L140910

Description The issue allows remote attackers to bypass authentication. This is achieved by setting the JAASConfig property in an MQTT client configuration.

Recommendations For WebSphere MQ version 8.0.0.1, apply the patch p000-001-L140910 to resolve the issue. As a temporary workaround, consider restricting access to the Telemetry Component until the patch is applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-6116

Produtos afetados

Websphere Mq

Referências · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21686210 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96213 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-6116 · Nota de Segurança
• http://secunia.com/advisories/61064 · Nota