PT-2023-29888 · Ibm · Ibm Mq Appliance

Published 2023-12-18 · Updated 2023-12-22 · CVE-2023-46177

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance versions 9.3 LTS and 9.3 CD

Description The issue allows a remote attacker to traverse directories on the system by sending a specially crafted URL request, potentially enabling the viewing of arbitrary files on the system.

Recommendations For IBM MQ Appliance versions 9.3 LTS and 9.3 CD, consider restricting access to the system until a fix is available, and avoid using specially crafted URL requests that could exploit the directory traversal issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-46177

Affected Products

Ibm Mq Appliance

References · 5

• https://osv.dev/vulnerability/CVE-2023-46177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46177 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/269536 · Vendor Advisory
• https://ibm.com/support/pages/node/7091235 · Vendor Advisory
• https://t.me/cvenotify/64949 · Telegram Post