Inclusion of Sensitive Information in Log Files in IBM MQ - CVE-2023-28950
Published: April 28, 2023
Vulnerability identifier: #VU75592
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-28950
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into trace files. A local user can read the trace files and gain access to sensitive data.
Affected software
IBM MQ
IBM Integration Bus
App Connect Enterprise Certified Container
IBM Sterling B2B Integrator
IBM App Connect Enterprise
IBM Integration Bus
App Connect Enterprise Certified Container
IBM Sterling B2B Integrator
IBM App Connect Enterprise
How to mitigate CVE-2023-28950
Install updates from vendor's website.
IBM MQ - addressed in versions 9.0.0.17, 9.2.0.11, 9.3.0.5, 9.3.2.1
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1