CVE-2015-0173

EPSS 0.17%
Veröffentlicht 28.06.2015 14:59:00
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle psirt@us.ibm.com
CVE-Watchlists
Login
Unerledigt
Login

The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ibm ≫ Websphere Mq Internet Pass Thru SwPlatformwebsphere_mq Version <= 2.1.0.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.17%	0.381

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

http://www-01.ibm.com/support/docview.wss?uid=swg21699547

Patch

Vendor Advisory

http://www.securitytracker.com/id/1032630

https://nvd.nist.gov/vuln/detail/CVE-2015-0173

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-0173

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-0173

EUVD