low3.5Public exploit code
CVE-2012-2206
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via ve…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- IBM Websphere MQ File Transfer Edition Web Gateway - Insufficient Access Control2012-08-13 · webapps · windows
Impact
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ibm | Websphere Mq | Versions 7.0, 7.0.0.1, 7.0.1.0, 7.0.2.0, 7.0.2.2, 7.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC82761
- http://www.exploit-db.com/exploits/20478/
- http://www.ibm.com/support/docview.wss?uid=swg21607481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77095
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC82761
- http://www.exploit-db.com/exploits/20478/
- http://www.ibm.com/support/docview.wss?uid=swg21607481
- https://exchange.xforce.ibmcloud.com/vulnerabilities/77095