Remote Information Disclosure in IBM MQ Appliance Web Console
CVE-2024-52896

6.2MEDIUM

Key Information:

Vendor
IBM
Status
MQ
Vendor
CVE Published:
19 December 2024

Summary

The IBM MQ Appliance web console suffers from a vulnerability that allows remote attackers to capture sensitive information through improperly handled detailed technical error messages. When error messages containing excessive detail are displayed, they can inadvertently reveal critical internal information that could be leveraged for further attacks. Organizations utilizing affected versions of IBM MQ Appliance need to implement security measures to prevent the exposure of sensitive data and reduce the attack surface.

Affected Version(s)

MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD

References

https://www.ibm.com/support/pages/node/7179152

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.