CVE-2015-0173 : The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS

The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Published 2015-06-28 14:59:00

Updated 2017-09-23 01:29:00

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-0173

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-0173

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

References for CVE-2015-0173

http://www-01.ibm.com/support/docview.wss?uid=swg21699547

IBM Security Bulletin: IBM WebSphere MQIPT Session IDs are predictable (CVE-2015-0173)
Patch;Vendor Advisory
http://www.securitytracker.com/id/1032630

IBM WebSphere MQIPT Predictable Session IDs Let Remote Users Intercept Data - SecurityTracker

Products affected by CVE-2015-0173

IBM » Websphere Mq Internet Pass Thru » For Websphere Mq
Versions up to, including, (<=) 2.1.0.1
cpe:2.3:a:ibm:websphere_mq_internet_pass_thru:*:*:*:*:*:websphere_mq:*:*
Matching versions

Vulnerability Details : CVE-2015-0173

Exploit prediction scoring system (EPSS) score for CVE-2015-0173

CVSS scores for CVE-2015-0173

CWE ids for CVE-2015-0173

References for CVE-2015-0173

Products affected by CVE-2015-0173