PT-2024-25427 · Ibm · Websphere Mq

Published 2024-04-16 · Updated 2024-12-05 · CVE-2024-3367

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.0.0 through 2.1.0 Checkmk versions prior to 2.2.0p26 Checkmk versions prior to 2.3.0b5

Description The issue allows a local attacker to inject an argument to runmqsc, potentially due to an untrusted data vulnerability in the websphere mq agent plugin.

Recommendations For Checkmk versions 2.0.0 through 2.1.0, upgrade Checkmk to the latest version. For Checkmk versions prior to 2.2.0p26, upgrade Checkmk to the latest version. For Checkmk versions prior to 2.3.0b5, upgrade Checkmk to the latest version. As a general mitigation measure, identify affected systems, review plugin usage and permissions.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2024-3367

Affected Products

Websphere Mq

References · 7

• https://osv.dev/vulnerability/CVE-2024-3367 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3367 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-3367 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-3367 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-3367 · Vendor Advisory
• https://checkmk.com/werk/16615 · Vendor Advisory
• https://twitter.com/oktsec/status/1780275684394389551 · Twitter Post