Input validation error in IBM MQ - CVE-2023-22874
Published: April 28, 2023
Vulnerability identifier: #VU75594
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-22874
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing configuration files. A local user can pass a specially crafted configuration file to the application and perform a denial of service (DoS) attack.
Affected software
IBM MQ
App Connect Enterprise Certified Container
IBM Sterling Secure Proxy
App Connect Enterprise Certified Container
IBM Sterling Secure Proxy
How to mitigate CVE-2023-22874
Install updates from vendor's website.
IBM MQ - addressed in versions 9.3.0.5, 9.3.2.0
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0
IBM Sterling Secure Proxy - update to 6.0.3 iFix 08