Input validation error in IBM MQ - CVE-2022-31772
Published: October 13, 2023
Vulnerability identifier: #VU82004
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31772
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
IBM MQ
App Connect Enterprise Certified Container
IBM Sterling Secure Proxy
App Connect Enterprise Certified Container
IBM Sterling Secure Proxy
How to mitigate CVE-2022-31772
Install updates from vendor's website.
IBM MQ - addressed in versions 8.0.0.16, 9.1.0.12, 9.2.0.6, 9.3.0.1
IBM Sterling Secure Proxy - update to 6.0.3 iFix 06
IBM Sterling Secure Proxy - update to 6.0.3 iFix 06