CVE-2012-3294 in WebSphere MQ

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in the Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier, and WebSphere MQ - Managed File Transfer 7.5, allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add user accounts via the /wmqfteconsole/Filespaces URI, (2) modify permissions via the /wmqfteconsole/FileSpacePermisssions URI, or (3) add MQ Message Descriptor (MQMD) user accounts via the /wmqfteconsole/UploadUsers URI.

Be aware that VulDB is the high quality source for vulnerability data.

• Reservation: 06/07/2012
• Disclosure: 08/17/2012
• Moderation: VulDB entry created
• Entries: 1: VDB-5974
• CPE: ready
• CWE: CWE-352 (Confirmed)
• Exploit: Download
• CVSS: 6.3
• EPSS: 0.00320
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2012-3294
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2012-3294
• CVE Details: https://www.cvedetails.com/cve/CVE-2012-3294/