CVE-2015-2012 — Sensitive Information Exposure in IBM Websphere MQ

CWE-200 — Sensitive Information ExposureCWE-25519 documents9 sources
Severity
4.0MEDIUMNVD
EPSS
0.0%
top 88.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere MQ
Timeline
PublishedFeb 8
Latest updateMay 17

Description

The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 2.5 | Impact: 1.4

Affected Packages1 packages

▶NVDibm/websphere_mq13 versions+12

🔴Vulnerability Details

2
GHSA
GHSA-jvqm-qh85-5q6r: The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7↗2022-05-17
▶
CVEList
CVE-2015-2012: The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7↗2016-02-08
▶

💥Exploits & PoCs

1
Nuclei
Microsoft Windows 'HTTP.sys' - Remote Code Execution
▶

🕵️Threat Intelligence

4
Trendmicro
Asruex Backdoor Infects Files Via Old Vulnerabilities↗2019-08-22
▶
Trendmicro
Asruex Backdoor Infects Files Via Old Vulnerabilities↗2019-08-22
▶
Trendmicro
Asruex Backdoor Infects Files Via Old Vulnerabilities↗2019-08-22
▶
Unit42
NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan↗2016-01-21
▶

💬Community

2
Bugzilla
CVE-2015-7312 kernel: multiple race conditions in aufs↗2020-08-10
▶
Bugzilla
CVE-2012-6685 rubygem-nokogiri: XML eXternal Entity (XXE) flaw↗2015-01-05
▶
CVE-2015-2012 — Sensitive Information Exposure in IBM | cvebase