CVE-2012-2206

IBM Websphere MQ - Access Control

Title source: rule
STIX 2.1

Description

The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.

Exploits (1)

exploitdb WRITEUP
by Nir Valtman · textwebappswindows
https://www.exploit-db.com/exploits/20478

References (4)

Core 4
Core References
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC82761
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/20478/
Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21607481
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/77095

Scores

EPSS 0.0772
EPSS Percentile 92.0%

Details

CWE
CWE-264
Status published
Products (7)
ibm/websphere_mq 7.0
ibm/websphere_mq 7.0.0.1
ibm/websphere_mq 7.0.1.0
ibm/websphere_mq 7.0.2.0
ibm/websphere_mq 7.0.2.2
ibm/websphere_mq 7.0.4
ibm/websphere_mq 7.0.4.0
Published Aug 17, 2012
Tracked Since Feb 18, 2026