PT-2018-13062 · Ibm · Ibm Websphere Mq

Published 2018-08-06 · Updated 2019-10-09 · CVE-2018-1551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ versions 8.0.0.2 through 8.0.0.8 IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.3

Description The issue allows users to have more authority than they should have if an MQ administrator creates an invalid user group name.

Recommendations For IBM WebSphere MQ versions 8.0.0.2 through 8.0.0.8, ensure that MQ administrators create valid user group names to prevent users from having excessive authority. For IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.3, ensure that MQ administrators create valid user group names to prevent users from having excessive authority. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-1551

Affected Products

Ibm Websphere Mq

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/142888 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1551 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10716113 · Vendor Advisory
• http://securityfocus.com/bid/105040 · Note