174 lines
7.6 KiB
JSON
174 lines
7.6 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-10030",
|
||
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "ibm",
|
||
"dateReserved": "2026-05-28T18:33:26.331Z",
|
||
"datePublished": "2026-09-18T15:47:15.484Z",
|
||
"dateUpdated": "2026-09-18T16:30:47.384Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
|
||
"shortName": "ibm",
|
||
"dateUpdated": "2026-09-18T15:47:15.484Z"
|
||
},
|
||
"title": "IBM MQ Console is vulnerable to privilege escalation",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-285",
|
||
"description": "CWE-285 Improper Authorization",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "IBM",
|
||
"product": "MQ",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "9.3.0.0",
|
||
"lessThanOrEqual": "9.3.0.41 LTS",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.3.0.0",
|
||
"lessThanOrEqual": "9.3.5.1 CD",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.4.0.0",
|
||
"lessThanOrEqual": "9.4.0.25 LTS",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.4.0.0",
|
||
"lessThanOrEqual": "9.4.5.1 CD",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "10.0.0.0"
|
||
}
|
||
],
|
||
"cpes": [
|
||
"cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:9.3.0.41:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:9.4.0.25:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:9.4.5.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:a:ibm:mq:10.0.0.0:*:*:*:*:*:*:*"
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.ibm.com/support/pages/node/7284894",
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"patch"
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
],
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"userInteraction": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"confidentialityImpact": "NONE",
|
||
"integrityImpact": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"baseSeverity": "HIGH",
|
||
"baseScore": 7.1,
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
|
||
}
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "This issue was addressed under Known Issue DT472093\nIBM MQ version 9.3 LTS\nApply cumulative security update 9.3.0.42\nIBM MQ version 9.4 LTS\nApply cumulative security update 9.4.0.26\nIBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0\nUpgrade to IBM MQ version 10.0.0.5",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>This issue was addressed under Known Issue DT472093</p><p>IBM MQ version 9.3 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update 9.3.0.42</a></p><p>IBM MQ version 9.4 LTS</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\">Apply cumulative security update</a><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\" rel=\"noopener noreferrer nofollow\"> 9.4.0.26</a></p><p>IBM MQ version 9.3 CD, 9.4 CD and 10.0.0.0</p><p><a href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-100\" rel=\"noopener noreferrer nofollow\">Upgrade to IBM MQ version 10.0.0.5</a></p>"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-18T16:22:46.518576Z",
|
||
"id": "CVE-2026-10030",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-18T16:30:47.384Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |