CVE-2015-0173

EPSS 0.17%
Published 28.06.2015 14:59:00
Last modified 12.04.2025 10:46:40
Source psirt@us.ibm.com
Teams watchlist Login
Open Login

The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Affected products Warnungen 0 Metrics 2 CWE 0 References 5

Data is provided by the National Vulnerability Database (NVD)

Ibm ≫ Websphere Mq Internet Pass Thru SwPlatformwebsphere_mq Version <= 2.1.0.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.17%	0.381

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

http://www-01.ibm.com/support/docview.wss?uid=swg21699547

Patch

Vendor Advisory

http://www.securitytracker.com/id/1032630

https://nvd.nist.gov/vuln/detail/CVE-2015-0173

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-0173

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-0173

EUVD