description: IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.
problem types: Gain Access
affected:
{
product: WebSphere MQ
vendor: IBM
versions:
status: affected, version: 8.0.0.2
status: affected, version: 8.0.0.4
status: affected, version: 8.0.0.3
status: affected, version: 8.0.0.6
status: affected, version: 8.0.0.5
status: affected, version: 8.0.0.7
status: affected, version: 8.0.0.8
status: affected, version: 9.0.0.0
status: affected, version: 9.0.0.1
status: affected, version: 9.0.0.2
status: affected, version: 9.0.0.3
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: NONE
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.7
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.0/A:N/AC:H/AV:N/C:N/I:L/PR:L/S:U/UI:N/E:U/RC:C/RL:O
version: 3.0
]