IBM MQ Operator 3.2.2 / 2.0.24: Auth Bypass via Partial String Compare
CVE-2024-39742 Published on July 8, 2024

IBM MQ Container authentication bypass
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-Force ID: 297169.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2024-39742 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Partial String Comparison

The software performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.


Products Associated with CVE-2024-39742

Want to know whenever a new CVE is published for IBM Mq Operator? stack.watch will email you.

 

Affected Versions

IBM MQ Operator: ibm mq_operator:

Exploit Probability

EPSS
0.05%
Percentile
16.79%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.