by Kastro
Paper/Archive/CVE-2022-22489

CVE-2022-22489

IBM MQ — IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML…

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 77.3.773 × 2015.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226339.

Affected

ProductAffectedFixed inSource
MQ8.0–CNA
MQ9.0.LTS–CNA
MQ9.1.LTS–CNA
MQ9.1.CD–CNA
MQ9.2.CD–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
ibm (CNA)8.2CVSS:3.0/AV:N/S:U/A:L/PR:N/UI:N/AC:L/C:H/I:N/RC:C/RL:O/E:U

References

refibm.com/support/pages/node/6613021refexchange.xforce.ibmcloud.com/vulnerabilities/226339