NetSight
IP …
medium6.8Public exploit code

CVE-2012-3294

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSph…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI, or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI.

Affected products

VendorProductAffected versions
IbmWebsphere Mq
through 7.0.4
Versions 7.0, 7.0.0.1, 7.0.1.0, 7.0.2.0, 7.0.2.2
IbmWebsphere Mq Managed File Transfer
Version 7.5

Weakness classification

CWE-352

References