CVE-2017-1337
HighSummary
IBM WebSphere MQ versions 9.0.1 and 9.0.2 may incorrectly transmit user credentials in plain text.
Risk Assessment
Transmitting credentials in plain text poses a risk of interception by unauthorized individuals, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to upgrade to the latest version of IBM WebSphere MQ and implement encryption for transmitted credentials.
Other vulnerabilities in IBM WebSphere MQ
See all- CVE-2017-1760High
IBM WebSphere MQ versions 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information.
- CVE-2017-1145High
IBM WebSphere MQ version 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource exhaustion.
- CVE-2016-0260High
A memory leak in queue-manager agents in IBM WebSphere MQ 8.x before version 8.0.0.5 allows remote attackers to cause a denial of service by triggering many errors.
Original NVD description (English source)
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text. IBM X-Force ID: 126245.