Input validation error in IBM MQ for HPE NonStop and IBM MQ - CVE-2023-28513

Vulnerability identifier: #VU80404

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28513

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling messages. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

IBM MQ for HPE NonStop
IBM MQ
IBM Integration Bus
IBM Sterling B2B Integrator
IBM App Connect Enterprise
IBM MQ Appliance

Install updates from vendor's website.

IBM MQ for HPE NonStop - update to 8.1.0.16
IBM MQ - addressed in versions 9.0.0.18, 9.1.0.16, 9.2.0.15, 9.3.0.6
IBM App Connect Enterprise - update to 11.0.0.22
IBM Sterling B2B Integrator - addressed in versions 6.1.2.5, 6.2.0.1
IBM MQ Appliance - addressed in versions 9.2.0.15, 9.2.5.8, 9.3.0.6, 9.3.3

• https://www.ibm.com/support/pages/node/7007731
• https://www.ibm.com/support/pages/node/7007421
• https://exchange.xforce.ibmcloud.com/vulnerabilities/250397
• https://www.ibm.com/support/pages/node/7030102

• Remote denial of service in IBM MQ
• Input validation error in IBM App Connect Enterprise and IBM Integration Bus
• Input validation error in IBM MQ Appliance
• Multiple vulnerabilities in IBM Sterling B2B Integrator