Low severity · published Dec 7, 2017
CVE-2017-1341
IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been denied access
3.7
CVSS
1%
EPSS
No
On KEV
Description
IBM WebSphere MQ 8.0 and 9.0 could allow, under special circumstances, an unauthorized user to access an object which they should have been denied access. IBM X-Force ID: 126456.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere MQ · Ibm
8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; 8.0.0.6; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1341
Issue Tracking
http://www.ibm.com/support/docview.wss?uid=swg22005400
Third Party Advisory
http://www.securityfocus.com/bid/102042
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/126456
More from Websphere MQ
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
8.6
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource…
8.1
CVE-2017-1337
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text
7.8
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on…
7.8
CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges