Unscored severity · published Nov 12, 2010
CVE-2010-2637
IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field, which allows remote attackers to obtain…
–
CVSS
1.7%
EPSS
No
On KEV
Description
IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field, which allows remote attackers to obtain sensitive information by sniffing the network traffic from a .NET client application.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere MQ · Ibm
6.0; 6.0.0.0; 6.0.1.0; 6.0.1.1; 6.0.2.0; 6.0.2.1; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2637
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ56005
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg27007069
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg27014224
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/63114
More from Websphere MQ
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
8.6
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource…
8.1
CVE-2017-1337
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text
7.8
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on…
7.8
CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges