CVE-2024-40681

IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7167732

Configurations

No configuration.

History

31 Oct 2024, 17:15

Type	Values Removed	Values Added
References	~~{'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/297611', 'source': 'psirt@us.ibm.com'}~~
Summary	~~(en) IBM MQ Operator 2.0.26 and 3.2.4 could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.~~	(en) IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.

09 Sep 2024, 13:03

Type	Values Removed	Values Added
Summary		(es) IBM MQ Operator 2.0.26 y 3.2.4 podrían permitir que un usuario autenticado con un rol específicamente definido evite restricciones de seguridad y ejecute acciones contra el gestor de colas.

07 Sep 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-07 15:15

Updated : 2024-10-31 17:15

NVD link : CVE-2024-40681

Mitre link : CVE-2024-40681

CVE.ORG link : CVE-2024-40681

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

7.5 /10