CVE-2024-51470 (GCVE-0-2024-51470)

Vulnerability from cvelistv5 – Published: 2024-12-18 19:56 – Updated: 2024-12-18 20:24
VLAI?
Summary
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-754 - Improper Check for Unusual or Exceptional Conditions
Assigner
ibm
References
Impacted products
Vendor Product Version
IBM MQ Affected: 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
    cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*
    cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*
    cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*
    cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*
    cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*
    cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*
 Create a notification for this product.
    IBM MQ Appliance Affected: 9.3 LTS, 9.3 CD, 9.4 LTS
    cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:lts:*:*:*
    cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:continuous_delivery:*:*:*
    cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:lts:*:*:*
 Create a notification for this product.
    IBM MQ for HPE NonStop Affected: 8.1.0 , ≤ 8.1.0.25 (semver)
    cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0.25:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-51470",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-18T20:24:17.133411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-18T20:24:38.409Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*",
            "cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*",
            "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*",
            "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*",
            "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*",
            "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MQ",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:lts:*:*:*",
            "cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:continuous_delivery:*:*:*",
            "cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:lts:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MQ Appliance",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "9.3 LTS, 9.3 CD, 9.4 LTS"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0.25:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "MQ for HPE NonStop",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "8.1.0.25",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM MQ\u0026nbsp;9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\u0026nbsp;9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\u0026nbsp;could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.\u003c/span\u003e"
            }
          ],
          "value": "IBM MQ\u00a09.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\u00a09.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\u00a0could allow an authenticated user to cause a denial-of-service due to messages with improperly set values."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-18T19:56:10.377Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7179137"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7178085"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7177593"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM MQ denial of service",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-51470",
    "datePublished": "2024-12-18T19:56:10.377Z",
    "dateReserved": "2024-10-28T10:50:18.700Z",
    "dateUpdated": "2024-12-18T20:24:38.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"IBM MQ\\u00a09.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\\u00a09.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\\u00a0could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.\"}, {\"lang\": \"es\", \"value\": \"IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS e IBM MQ para HPE NonStop 8.1.0 a 8.1.0.25 podr\\u00edan permitir que un usuario autenticado provoque una denegaci\\u00f3n de servicio debido a mensajes con valores configurados incorrectamente.\"}]",
      "id": "CVE-2024-51470",
      "lastModified": "2024-12-18T20:15:23.233",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-18T20:15:23.233",
      "references": "[{\"url\": \"https://www.ibm.com/support/pages/node/7177593\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"https://www.ibm.com/support/pages/node/7178085\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"https://www.ibm.com/support/pages/node/7179137\", \"source\": \"psirt@us.ibm.com\"}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"psirt@us.ibm.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-754\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-51470\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2024-12-18T20:15:23.233\",\"lastModified\":\"2025-08-15T18:30:37.550\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM MQ\u00a09.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\u00a09.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\u00a0could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.\"},{\"lang\":\"es\",\"value\":\"IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS e IBM MQ para HPE NonStop 8.1.0 a 8.1.0.25 podr\u00edan permitir que un usuario autenticado provoque una denegaci\u00f3n de servicio debido a mensajes con valores configurados incorrectamente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"9.1.0.0\",\"versionEndExcluding\":\"9.1.0.26\",\"matchCriteriaId\":\"F8B4FFCB-1CBA-491E-A6E1-1B9F29F576BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"9.2.0.0\",\"versionEndExcluding\":\"9.2.0.30\",\"matchCriteriaId\":\"945763C9-93DF-4CE1-9FD1-094C2B3F51E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"9.3.0.0\",\"versionEndExcluding\":\"9.3.0.26\",\"matchCriteriaId\":\"33729184-9686-4978-B07B-A8D6812D7CA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_appliance:*:*:*:*:continuous_delivery:*:*:*\",\"versionStartIncluding\":\"9.4.0.0\",\"versionEndExcluding\":\"9.4.0.7\",\"matchCriteriaId\":\"77272CBE-353F-401B-BE68-8089B6D82925\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"9.4.0.0\",\"versionEndExcluding\":\"9.4.0.7\",\"matchCriteriaId\":\"23D00D18-C3B5-4D67-887F-3DED3468E9DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:mq_for_hpe_nonstop:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0\",\"versionEndExcluding\":\"8.1.0.26\",\"matchCriteriaId\":\"35DB0F1D-3B83-4F09-888A-663D6715CC72\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7177593\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7178085\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.ibm.com/support/pages/node/7179137\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-51470\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-18T20:24:17.133411Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-18T20:24:28.285Z\"}}], \"cna\": {\"title\": \"IBM MQ denial of service\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*\", \"cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*\", \"cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*\", \"cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*\", \"cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*\", \"cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"MQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:lts:*:*:*\", \"cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:continuous_delivery:*:*:*\", \"cpe:2.3:a:ibm:mq_appliance:9.4:*:*:*:lts:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"MQ Appliance\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.3 LTS, 9.3 CD, 9.4 LTS\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:mq_for_hpe_nonstop:8.1.0.25:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"MQ for HPE NonStop\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0.25\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7179137\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7178085\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.ibm.com/support/pages/node/7177593\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM MQ\\u00a09.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\\u00a09.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\\u00a0could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eIBM MQ\u0026nbsp;9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance\u0026nbsp;9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25\u0026nbsp;could allow an authenticated user to cause a denial-of-service due to messages with improperly set values.\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-754\", \"description\": \"CWE-754 Improper Check for Unusual or Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2024-12-18T19:56:10.377Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-51470\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-18T20:24:38.409Z\", \"dateReserved\": \"2024-10-28T10:50:18.700Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2024-12-18T19:56:10.377Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.