Products
IBM MQ Console
- 9.3 LTS
- 9.3 CD
Source
psirt@us.ibm.com
Tags
CVE-2024-35155 details
Published : June 28, 2024, 6:15 p.m.
Last Modified : June 28, 2024, 6:15 p.m.
Last Modified : June 28, 2024, 6:15 p.m.
Description
IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 292765.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.5 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Base Score
6.5
Exploitability Score
2.8
Impact Score
3.6
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
| URL | Source |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/292765 | psirt@us.ibm.com |
| https://www.ibm.com/support/pages/node/7158059 | psirt@us.ibm.com |
This website uses the NVD API, but is not approved or certified by it.