IBM MQ Operator 3.2.2 / 2.0.24: Auth Bypass via Partial String Compare
CVE-2024-39742 Published on July 8, 2024
IBM MQ Container authentication bypass
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.
Vulnerability Analysis
CVE-2024-39742 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Partial String Comparison
The software performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.
Products Associated with CVE-2024-39742
Want to know whenever a new CVE is published for IBM Mq Operator? stack.watch will email you.
Affected Versions
IBM MQ Operator:- Version 2.0.24, 3.2.2 is affected.
- Version 2.0.24 is affected.
- Version 3.2.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.