Session Management Flaw in IBM MQ Appliance
CVE-2022-40230

6.5MEDIUM

Key Information:

Vendor
IBM
Status
IBM MQ Appliance
Vendor
CVE Published:
3 November 2022

Summary

IBM MQ Appliance versions 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS contain a vulnerability where user sessions are not invalidated after logout. This oversight can potentially allow an authenticated user to impersonate another user, posing a significant risk to system security. Proper session handling is crucial to prevent unauthorized access and ensure user integrity. For further information, visit IBM's official documentation.

Affected Version(s)

IBM MQ Appliance "9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3"

References

https://www.ibm.com/support/pages/node/6622051

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.