Unscored severity · published Aug 17, 2012
CVE-2012-2206
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a…
–
CVSS
2%
EPSS
No
On KEV
Description
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Websphere MQ · Ibm
7.0; 7.0.0.1; 7.0.1.0; 7.0.2.0; 7.0.2.2; 7.0.4; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2206
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2206
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IC82761
Exploit
http://www.exploit-db.com/exploits/20478/
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21607481
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/77095
More from Websphere MQ
9.8
CVE-2020-4682
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data
8.6
CVE-2017-1145
IBM WebSphere MQ 8.0.0.6 does not properly terminate channel agents when they are no longer needed, which could allow a user to cause a denial of service through resource…
8.1
CVE-2017-1337
IBM WebSphere MQ 9.0.1 and 9.0.2 Java/JMS application can incorrectly transmit user credentials in plain text
7.8
CVE-2019-4078
IBM WebSphere MQ 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1 could allow a local non privileged user to execute code as an administrator due to incorrect permissions set on…
7.8
CVE-2018-1998
IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges