Account Credential Enumeration in IBM MQ Appliance
CVE-2022-22356

5.3MEDIUM

Key Information:

Vendor
IBM
Status
MQ Appliance
Vendor
CVE Published:
5 April 2022

Summary

The IBM MQ Appliance versions 9.2 CD and 9.2 LTS contain a vulnerability that could allow an attacker to enumerate valid account credentials. This issue arises from a notable difference in the response behavior for valid versus invalid login attempts, enabling an attacker to infer the existence of valid user accounts based on the differences in response times. Organizations utilizing these versions should take precautionary measures to safeguard their accounts.

Affected Version(s)

MQ Appliance 9.2 LTS

MQ Appliance 9.2 CD

References

https://www.ibm.com/support/pages/node/6564711
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/220487
vdb-entryx_refsource_XF

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.