Cleartext transmission of sensitive information in IBM MQ Operator - CVE-2023-47745

Vulnerability identifier: #VU87126

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-47745

CWE-ID: CWE-319

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A local user with ability to intercept network traffic can gain access to sensitive data.

IBM MQ Operator
IBM Intelligent Operations Center
IBM MQ
IBM Robotic Process Automation
IBM Supplied MQ Advanced Queue Manager Container images
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

IBM MQ Operator - addressed in versions 2.0.19, 3.1.0
IBM MQ - addressed in versions 9.3.0.16, 9.3.5
IBM Supplied MQ Advanced Queue Manager Container images - addressed in versions 9.3.0.16-r1, 9.3.3.3-r2, 9.3.5.0-r1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
IBM Robotic Process Automation - addressed in versions 21.0.7.15, 23.0.16

• https://www.ibm.com/support/pages/node/7126571
• https://exchange.xforce.ibmcloud.com/vulnerabilities/272638

• Cleartext transmission of sensitive information in IBM MQ
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Intelligent Operations Center (IOC)
• Multiple vulnerabilities in IBM Robotic Process Automation