Unscored severity · published Oct 19, 2014
CVE-2014-4822
IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured…
–
CVSS
0.4%
EPSS
No
On KEV
Description
IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere MQ · Ibm
8.0.0.0 · source: NVD
WM
Websphere MQ Explorer · Ibm
7.5.0.0; 7.5.0.1; 7.5.0.2; 7.5.0.3; 7.5.0.4; 8.0.0.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4822
secunia.com
http://secunia.com/advisories/59921
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IT04023
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686339
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/95467
More from Websphere MQ
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
8.6
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource…
8.1
CVE-2017-1337
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text
7.8
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on…
7.8
CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges