CVE-2015-5011 : IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSIST

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.

Published 2015-10-26 02:59:03

Updated 2015-10-27 01:13:11

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2015-5011

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-5011

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.2	LOW	AV:L/AC:L/Au:S/C:N/I:P/A:P	3.1	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-5011

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-5011

http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139

IBM notice: The page you requested cannot be displayed
Patch;Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21967265

IBM Security Bulletin: MQSISTOP/STARTMSGFLOW commands with unauthorized user succeed affects IBM WebSphere Message Broker and IBM Integration Bus (CVE-2015-5011)
Vendor Advisory

Products affected by CVE-2015-5011

IBM » Websphere Message Broker » Version: 8.0
cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Message Broker » Version: 8.0.0.1
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Message Broker » Version: 8.0.0.2
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Message Broker » Version: 8.0.0.3
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Message Broker » Version: 8.0.0.5
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Websphere Message Broker » Version: 8.0.0.4
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Integration Bus » Version: 9.0
cpe:2.3:a:ibm:integration_bus:9.0:*:*:*:*:*:*:*
Matching versions
IBM » Integration Bus » Version: 9.0.0.1
cpe:2.3:a:ibm:integration_bus:9.0.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Integration Bus » Version: 9.0.0.2
cpe:2.3:a:ibm:integration_bus:9.0.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Integration Bus » Version: 9.0.0.3
cpe:2.3:a:ibm:integration_bus:9.0.0.3:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-5011

Exploit prediction scoring system (EPSS) score for CVE-2015-5011

CVSS scores for CVE-2015-5011

CWE ids for CVE-2015-5011

References for CVE-2015-5011

Products affected by CVE-2015-5011