Session Management Flaw in IBM MQ Appliance
CVE-2022-40230
6.5MEDIUM
Summary
IBM MQ Appliance versions 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS contain a vulnerability where user sessions are not invalidated after logout. This oversight can potentially allow an authenticated user to impersonate another user, posing a significant risk to system security. Proper session handling is crucial to prevent unauthorized access and ensure user integrity. For further information, visit IBM's official documentation.
Affected Version(s)
IBM MQ Appliance "9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3"
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved