PT-2022-10826 · Ibm · Ibm Mq Appliance

Published 2022-03-01 · Updated 2022-03-09 · CVE-2021-38986

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance versions 9.2 CD and 9.2 LTS

Description The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after logout.

Recommendations For IBM MQ Appliance versions 9.2 CD and 9.2 LTS, consider implementing a custom session invalidation mechanism after user logout as a temporary workaround until a patch is available. Restrict access to sensitive features and data to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-38986

Affected Products

Ibm Mq Appliance

References · 6

• https://osv.dev/vulnerability/CVE-2021-38986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38986 · Security Note
• https://ibm.com/support/pages/node/6560032 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/212942 · Vendor Advisory
• https://t.me/cvenotify/27965 · Telegram Post
• https://t.me/cibsecurity/38266 · Telegram Post