CVE-2022-42436 : IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a loc

IBM MQ 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0 Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. IBM X-Force ID: 238206.

Published 2023-02-12 04:15:16

Updated 2023-02-21 19:17:08

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2022-42436

IBM » MQ » Version: 9.1.0.0 LTS Edition
cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.2.0 Continuous Delivery Edition
cpe:2.3:a:ibm:mq:9.2.0:*:*:*:continuous_delivery:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.2.0 LTS Edition
cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.1.0 Continuous Delivery Edition
cpe:2.3:a:ibm:mq:9.1.0:*:*:*:continuous_delivery:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 8.0.0.0
cpe:2.3:a:ibm:mq:8.0.0.0:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.0.0.0 LTS Edition
cpe:2.3:a:ibm:mq:9.0.0.0:*:*:*:lts:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.3.0 LTS Edition
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A
IBM » MQ » Version: 9.3.0 Continuous Delivery Edition
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » I » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
When used together with: Oracle » Solaris » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-42436

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-42436

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.5	1.4	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2022-42436

https://exchange.xforce.ibmcloud.com/vulnerabilities/238206

Broken Link
https://www.ibm.com/support/pages/node/6909467

Security Bulletin: IBM MQ Managed File Transfer could allow a local user to obtain sensitive information from diagnostic files. (CVE-2022-42436)
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-42436

Products affected by CVE-2022-42436

Exploit prediction scoring system (EPSS) score for CVE-2022-42436

CVSS scores for CVE-2022-42436

References for CVE-2022-42436