CVE-2015-5011 — LOW (3.2) — White Hats Nepal

Vulnerability Description

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.

CVSS Score

3.2

LOW

AV:L/AC:L/Au:S/C:N/I:P/A:P

Confidentiality

NONE

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Ibm	Websphere Message Broker	8.0
Ibm	Integration Bus	9.0

Related Weaknesses (CWE)

CWE-77

References

http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139PatchVendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21967265Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139PatchVendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21967265Vendor Advisory

FAQ

What is CVE-2015-5011?

CVE-2015-5011 is a vulnerability with a CVSS score of 3.2 (LOW). IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass inte...

How severe is CVE-2015-5011?

CVE-2015-5011 has been rated LOW with a CVSS base score of 3.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-5011?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Websphere Message Broker, Ibm Integration Bus.