CVE-2015-0173

Published: Jun 28, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value.

Affected (1)

Products: Ibm: Websphere Mq Internet Pass Thru

1 product

Websphere Mq Internet Pass Thru

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Websphere Mq Internet Pass Thru	Up to 2.1.0.1

Related CWEs

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21699547

Source: psirt@us.ibm.com

PatchVendor Advisory

http://www.securitytracker.com/id/1032630

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21699547

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securitytracker.com/id/1032630

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.