PT-2019-16980 · Ibm · Ibm Mq

CVE-2019-4227 · Publicado 2019-10-04 · Atualizado 2022-12-02

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM MQ versions 8.0.0.4 through 8.0.0.12 IBM MQ versions 9.0.0.0 through 9.0.0.6 IBM MQ versions 9.1.0.0 through 9.1.0.2 IBM MQ versions 9.1.0 through 9.1.2

Description The issue allows an unauthorized user to conduct a session fixation attack. This is due to clients not being disconnected as they should, specifically affecting AMQP Listeners.

Recommendations For IBM MQ versions 8.0.0.4 through 8.0.0.12, update to a version outside of this range to resolve the issue. For IBM MQ versions 9.0.0.0 through 9.0.0.6, update to a version outside of this range to resolve the issue. For IBM MQ versions 9.1.0.0 through 9.1.0.2, update to a version outside of this range to resolve the issue. For IBM MQ versions 9.1.0 through 9.1.2, update to a version outside of this range to resolve the issue.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2019-4227

Produtos afetados

Ibm Mq

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-4227 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-4227 · Nota de Segurança
• https://ibm.com/support/pages/node/886899 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/159352 · Aviso do Fabricante