PT-2022-25297 · Ibm · Ibm Mq Appliance

Published 2022-11-03 · Updated 2022-11-04 · CVE-2022-40230

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance versions 9.2 CD through 9.3 LTS

Description The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout.

Recommendations For IBM MQ Appliance versions 9.2 CD through 9.3 LTS, consider restricting access to sensitive features that could be exploited by an impersonated user until a patch is available. As a temporary workaround, consider implementing additional authentication checks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-40230

Affected Products

Ibm Mq Appliance

References · 4

• https://ibm.com/support/pages/node/6622051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40230 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40230 · Vendor Advisory
• https://t.me/cvenotify/37059 · Telegram Post