Medium severity · published Oct 4, 2017
CVE-2017-1126
IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further…
5.3
CVSS
1.2%
EPSS
No
On KEV
Description
IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive information about software versions that could lead to further attacks. IBM X-Force ID: 121341.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Integration Bus · Ibm
9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.4; 9.0.0.5; 9.0.0.6; +12 more · source: NVD
WM
Websphere Message Broker · Ibm
8.0.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1126
Issue Tracking
http://www.ibm.com/support/docview.wss?uid=swg22008470
Third Party Advisory
http://www.securityfocus.com/bid/101104
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/121341
More from Integration Bus
9.1
CVE-2016-9706
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when…
8.1
CVE-2017-1694
IBM Integration Bus 9.0 and 10.0 transmits user credentials in plain in clear text which can be read by an attacker using man in the middle techniques
6.7
CVE-2025-36014
IBM Integration Bus for z/OS code injection
6.5
CVE-2024-27265
IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
6.5
CVE-2024-22332
The IBM Integration Bus for z/OS 10.1 through 10.1.0.2 AdminAPI is vulnerable to a denial of service due to file system exhaustion