PT-2024-28983 · Ibm · Ibm Mq Operator+1

Published 2024-09-07 · Updated 2025-08-15 · CVE-2024-40681

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM MQ versions 9.1 LTS through 9.4 CD IBM MQ Operator versions 2.0.26 through 3.2.4

Description The issue allows an authenticated user in a specifically defined role to bypass security restrictions and execute actions against the queue manager.

Recommendations For IBM MQ versions 9.1 LTS through 9.4 CD, update to a version that includes the security fix for this issue. For IBM MQ Operator versions 2.0.26 through 3.2.4, update to a version that includes the security fix for this issue. As a temporary workaround, consider restricting access to the queue manager for authenticated users with specifically defined roles until a patch is available.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-40681

Affected Products

Ibm Mq

Ibm Mq Operator

References · 13

• https://osv.dev/vulnerability/CVE-2024-40681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40681 · Security Note
• https://ibm.com/support/pages/node/7167732 · Vendor Advisory
• https://t.me/cvenotify/100203 · Telegram Post
• https://t.me/cvedetector/5027 · Telegram Post
• https://twitter.com/CVEnew/status/1832421939874349317 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1832457385429897418 · Twitter Post
• https://t.me/cveNotify/132446 · Telegram Post
• https://t.me/cvenotify/93681 · Telegram Post
• https://twitter.com/vuldb/status/1832484488414388496 · Twitter Post
• https://twitter.com/AegisLens/status/1832498729208733784 · Twitter Post
• https://twitter.com/cracbot/status/1834109741372768557 · Twitter Post
• https://t.me/latest_high_impact_cve/1109 · Telegram Post