CVE-2022-40230 — Insufficient Session Expiration in IBM MQ Appliance

CWE-613 — Insufficient Session Expiration3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 54.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM MQ Appliance
Timeline
PublishedNov 3
Latest updateNov 4

Description

"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDibm/mq_appliance9.2.0.0, 9.3.0.0+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rx2f-pj28-88g5: "IBM MQ Appliance 9↗2022-11-04
▶
CVEList
CVE-2022-40230: "IBM MQ Appliance 9↗2022-11-03
▶
CVE-2022-40230 — Insufficient Session Expiration in IBM | cvebase