IBM MQ Java messaging is vulnerable to XML external entity injection (IBM MQ)
En bref
- Source
- NVD
- EPSS
- EPSS 0.46 % · centile 40 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ibm
- Statut NVD
- Awaiting Analysis
Rechercher sur…
Description
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.
Faiblesses (CWE)
- CWE-611 — Entité externe XML (XXE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | ibm |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · psirt@us.ibm.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-78873
- GCVE · GCVE-0-2026-12666
Produits affectés
| Produit | Versions |
|---|---|
| IBM · MQ | affected 9.1.0.0 ≤ 9.1.0.37 LTS ; affected 9.2.0.0 ≤ 9.2.0.43 LTS ; affected 9.3.0.0 ≤ 9.3.0.41 LTS ; affected 9.3.0.0 ≤ 9.3.5.1 CD ; affected 9.4.0.0 ≤ 9.4.0.25 LTS ; affected 9.4.0.0 ≤ 9.4.5.1 CD |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |