CVE-2015-5011

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.

Published: Oct 26, 2015
Updated: Apr 13, 2023
CVE: CVE-2015-5011
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 3.2
AV:L/AC:L/Au:S/C:N/I:P/A:P

CWEs:

CWE-77

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
ibm / websphere_message_broker	8.0	8.0.x
ibm / websphere_message_broker	8.0.0.2	8.0.0.2.x
ibm / websphere_message_broker	8.0.0.4	8.0.0.4.x
ibm / websphere_message_broker	8.0.0.3	8.0.0.3.x
ibm / websphere_message_broker	8.0.0.5	8.0.0.5.x
ibm / websphere_message_broker	8.0.0.1	8.0.0.1.x
ibm / integration_bus	9.0.0.2	9.0.0.2.x
ibm / integration_bus	9.0.0.1	9.0.0.1.x
ibm / integration_bus	9.0	9.0.x
ibm / integration_bus	9.0.0.3	9.0.0.3.x

http://www-01.ibm.com/support/docview.wss?uid=swg1PI28139
http://www-01.ibm.com/support/docview.wss?uid=swg21967265

Vulnerability Database

CVE-2015-5011