CVE-2012-2206 The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as d...
LowCVSS 3.5
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm websphere mq | = 7.0 | No fix listed |
| ibm websphere mq | = 7.0.0.1 | No fix listed |
| ibm websphere mq | = 7.0.1.0 | No fix listed |
| ibm websphere mq | = 7.0.2.0 | No fix listed |
| ibm websphere mq | = 7.0.2.2 | No fix listed |
| ibm websphere mq | = 7.0.4 | No fix listed |
| ibm websphere mq | = 7.0.4.0 | No fix listed |
References
- IC82761 vendor-advisory
- 20478 exploit
- www.ibm.com vendor-advisory
- wmq-ftewg-security-bypass(77095) vdb-entry