PT-2018-14272 · Ibm · Websphere Mq

Published 2018-11-13 · Updated 2019-10-09 · CVE-2018-1792

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM WebSphere MQ versions 8.0.0.0 through 8.0.0.10 IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.5 IBM WebSphere MQ versions 9.0.1 through 9.0.5 IBM WebSphere MQ version 9.1.0.0

Description The issue allows a local user to inject code that could be executed with root privileges.

Recommendations For IBM WebSphere MQ versions 8.0.0.0 through 8.0.0.10, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 9.0.0.0 through 9.0.0.5, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ versions 9.0.1 through 9.0.5, update to a version outside of this range to resolve the issue. For IBM WebSphere MQ version 9.1.0.0, update to a newer version to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-1792

Affected Products

Websphere Mq

References · 5

• https://osv.dev/vulnerability/CVE-2018-1792 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10734447 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1792 · Security Note
• http://securityfocus.com/bid/105936 · Note