Inclusion of Sensitive Information in Log Files in IBM MQ - CVE-2022-42436

Vulnerability identifier: #VU75608

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-42436

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files in Managed File Transfer. A local user can read the log files and gain access to sensitive data.

IBM MQ
App Connect Enterprise Certified Container
IBM Sterling B2B Integrator
IBM Integration Bus
IBM App Connect Enterprise

Install updates from vendor's website.

IBM MQ - addressed in versions 9.0.0.14, 9.1.0.13, 9.2.0.7, 9.3.0.2, 9.3.1.1
App Connect Enterprise Certified Container - addressed in versions 5.0.6, 8.1.0
IBM Sterling B2B Integrator - addressed in versions 6.0.3.8, 6.1.2.1
IBM Integration Bus - addressed in versions 10.0.0.26, 10.1
IBM App Connect Enterprise - addressed in versions 11.0.0.20, 12.0.8.0

• https://exchange.xforce.ibmcloud.com/vulnerabilities/238206
• https://www.ibm.com/support/pages/node/6909467

• Information disclosure in IBM MQ Managed File Transfer
• Information disclosure in IBM Sterling B2B Integrator
• Information disclosure in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus