XLinkedIn
1 973-826-7406|info@AvadaSoftware.com

Addressing the Latest MQ Console Vulnerability

By |Published On: June 7th, 2024|1 min read|
Table of Contents

9/5/2024 – Critical MQ Console Vulnerability

A recent security bulletin from IBM has highlighted a critical MQ Console vulnerability identified as CVE-2024-40681. This vulnerability affects several IBM MQ versions, including 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, and 9.4 LTS and CD, allowing an authenticated user to bypass security restrictions and execute unauthorized actions against the queue manager.

To mitigate this MQ Console vulnerability, IBM recommends applying the appropriate security updates or fix packs as detailed under APAR IT46501. For a full list of affected versions and remediation steps, please visit the IBM Security Bulletin.

 

 

Click here to learn about a secure, cloud-ready, single-interface solution for administration, monitoring, synthetic transactions, user Auditing, and in-depth analytics of your IBM MQ environment.

6/28/2024 CVE CVE-2024-35155 MQ Console vulnerability

A vulnerability in 9.3 LTS and 9.3 CD permits a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM MQ has addressed the password disclosure vulnerability in the IBM MQ Console:

 

Remediation/Fixes

This issue was addressed under APAR IT46217

IBM MQ version 9.3 LTS

Apply Fix Pack 9.3.0.20  

IBM MQ version 9.3 CD

Upgrade to IBM MQ version 9.4

Workarounds and Mitigations

None

 

 

 

Click here to learn about a secure, cloud-ready, single-interface solution for administration, monitoring, synthetic transactions, user Auditing, and in-depth analytics of your IBM MQ environment.

Related Posts

Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360
Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360
Gallery

Simplifying Message Filtering and Selection for Accurate Test Scenarios with Infrared360

November 20th, 2024
Critical ReDoS and SSRF ACE Vulnerabilities Addressed
Critical ReDoS and SSRF ACE Vulnerabilities Addressed
Gallery

Critical ReDoS and SSRF ACE Vulnerabilities Addressed

November 20th, 2024
Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation
Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation
Gallery

Webinar: Maximize the value of your data by integrating IBM MQ and IBM Event Automation

November 18th, 2024
Addressing Two IBM App Connect Enterprise Vulnerabilities
Addressing Two IBM App Connect Enterprise Vulnerabilities
Gallery

Addressing Two IBM App Connect Enterprise Vulnerabilities

November 12th, 2024
How the IBM MQ Kafka Connector Works
How the IBM MQ Kafka Connector Works
Gallery

How the IBM MQ Kafka Connector Works

November 10th, 2024
Ensuring Security in IBM App Connect Enterprise: Addressing JMS Credential Vulnerability in IBM ACE
Ensuring Security in IBM App Connect Enterprise: Addressing JMS Credential Vulnerability in IBM ACE
Gallery

Ensuring Security in IBM App Connect Enterprise: Addressing JMS Credential Vulnerability in IBM ACE

November 9th, 2024
Essential KPIs for Effective ACE Monitoring
Essential KPIs for Effective ACE Monitoring
Gallery

Essential KPIs for Effective ACE Monitoring

October 30th, 2024
Remote IBM ACE/ MQ Engineer/Admin Job
Remote IBM ACE/ MQ Engineer/Admin Job
Gallery

Remote IBM ACE/ MQ Engineer/Admin Job

October 28th, 2024
IBM MQ Enhancement: Addresses Duplicate Cluster Receiver Channel Creation with Advanced Error Detection
IBM MQ Enhancement: Addresses Duplicate Cluster Receiver Channel Creation with Advanced Error Detection
Gallery

IBM MQ Enhancement: Addresses Duplicate Cluster Receiver Channel Creation with Advanced Error Detection

October 4th, 2024
Proactive Middleware Health Monitoring: The Key to Maintaining a Resilient IT Environment
Proactive Middleware Health Monitoring: The Key to Maintaining a Resilient IT Environment
Gallery

Proactive Middleware Health Monitoring: The Key to Maintaining a Resilient IT Environment

September 30th, 2024

More Infrared360® Resources

Articles & Papers

Overcome the Challenges of Moving Core Banking and Transaction Processing to the Cloud

Secure the Edge with IBM® DataPower® Gateway Appliance

5 Challenges & Solutions When Modernizing Your Middleware Infrastructure

Proactive vs. Forensic – Middleware – Health Monitoring

Seven Middleware Challenges You Must Overcome Before Your Cloud Migration

Monitoring Widely Distributed Environments Without Losing Focus

eBook: Inside IBM MQ Deployment Choices

Contain Costs and Mitigate Risks of Transactions on the Middleware Superhighway

Case Studies

Parker Hannifin Improves Efficiencies Across Business Units with Infrared360® and Trusted Spaces™

Alight Implements Secure, Holistic Self-Service Messaging

Sompo International Builds Business Platform Optimization with SOAP and REST Monitoring

The power of a healthy network: Visiting Nurse Service of New York harnesses IBM, partner technology to streamline patient care.

Video

The Business Case for Modernizing Your MQ Estate Today

Improving Productivity Through Smart, Safe Self-Service

Managing Middleware in Hybrid Cloud

Integrating Data in the Cloud with IBM App Connect

Transforming Your IBM MQ Estate Using Containers

Integration Modernization Lessons Learned

IBM MQ: Enterprise-wide Integration for Modern Distributed Environments

Understanding External Influences on Your Integration Strategy and Direction

Analyst Reports

Peer Reviews for Infrared360®

Avada Software Named a Most Promising IBM Solution Provider for 2023

Avada Software named one of Most Promising IBM Solutions Providers for 2022

A Systems Integrator and Services Provider Cuts Costs, Creates New Revenue Streams While Improving Service Delivery

Infrared360 named one of CIOReview’s 20 Most Promising APM Solution Providers

Analyst Report: Managing an IBM MQ Environment at USBank

CIO Feedback/Data Sheet

About the Author: Scott Treggiari

AVADA SOFTWARE AT A GLANCE

Avada Software’s flagship product, Infrared360®, is an IT management portal providing total administration, monitoring, testing, auditing, analytics dashboards, and self-service for cloud, on-prem, or hybrid environments. Get secure, collaborative management of elements across your IT stack like Kafka®, IBM® MQ, IBM® ACE/IIB, ActiveMQ®, WebSphere®, JBoss®, and Tomcat® Application Servers, URLs, SOAP & REST-based web services, IBM® DataPower® and MQ Appliance.

Latest Insight

The Middleware Blog

June 2nd, 2022|

IBM MQ Job – Technical Architect

 

Location: Hybrid – Centurion and home office
Travel: International
Employment Type: Fixed Term
Formal Qualification: Matric (Grade 12) / Relevant IT degree / Diploma
Legal Requirements: Passed credit and criminal checks
S.A Citizen or valid work permit for S.A

Basic Function and Scope of Responsibilities: For this IBM MQ job, the Technical Architect will be […]

Read More

May 26th, 2022|

Should a Mainframe IBM MQ Administrator be GUI Oriented (or – why is it important to have third party administrative tools)?

There are several tools that are used to simplify mainframe research and analysis of that complex environment.  Most of them are green screen based and require knowledge of z/OS ISPF panels and arcane command syntax, that once familiar to a z/OS Systems Programmer, can become second nature.  But in today’s […]

Read More

May 25th, 2022|

IBM MQ Vulnerability Alert:

Current Description of this IBM MQ  Vulnerability Alert (IBM MQ for HPE NonStop 8.1.0) can inadvertently disclose sensitive information under certain circumstances to a local user from a stack trace. IBM X-Force ID: 218853.

Severity CVSS 3.x Severity and Metrics:

Specifications

 

This IBM MQ Vulnerability Alert was provided by NIST. NVD Analysts use publicly available information to associate […]

Read More

May 5th, 2022|

Below is a recent post for a WebSphere Application Server Job we found:

 

 

Psybergate is an IT company that builds bespoke software solutions and provides specialized resourcing for client projects.
[They] are looking for a Senior JAVA Developer to join [their] financial services client based in Sandton for a 1 year contract role.


What you will be doing:

    • We are looking for an […]
Read More

April 28th, 2022|

WebSphere Automation 1.3 update and “How to” Deep Dive

Join the WebSphere Automation team in a “How To” deep dive and an overview of WebSphere Automation 1.3+ Speakers: Mike Thompson, Lead Product Manager for WebSphere Automation and Brian Hanczaryk, Lead WebSphere System Test Check out a teaser blog : https://community.ibm.com/community/user/wasdevops/blogs/brian-hanczaryk/2022/03/23/websphere-automation-how-to-series-1-how-to-get-we?CommunityKey=5c4ba155-561a-4794-9883-bb0c6164e14e

 

Click here to view original web page at community.ibm.com

 

Read More

April 27th, 2022|

Using IBM App Connect Enterprise patterns for developing integration solutions

An IBM App Connect Enterprise pattern is a reusable solution that encapsulates a tested approach to solving a common architecture, design, or deployment task in a particular context.

A pattern captures a tested solution to a commonly recurring problem, addressing the objectives that you want to achieve. The specification of a pattern describes the problem […]

Read More

We are proud supporters of:

Avada Software. All Rights Reserved |This website may contain logos and trademarks of third parties. These are the property of their respective owners and are used on this site for informational purposes only. Avada Software does not claim any ownership or association with these trademarks or, except where explicitly stated, their respective organizations. | Privacy Policy
Go to Top