CVE-2012-2206
Last modified
CVE-2012-2206 is a vulnerability of currently unknown severity. The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.. EPSS estimates a 2.01% chance of exploitation in the next 30 days.
Description
The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Websphere Mq | 7.0 |
| Ibm | Websphere Mq | 7.0.0.1 |
| Ibm | Websphere Mq | 7.0.1.0 |
| Ibm | Websphere Mq | 7.0.2.0 |
| Ibm | Websphere Mq | 7.0.2.2 |
| Ibm | Websphere Mq | 7.0.4 |
| Ibm | Websphere Mq | 7.0.4.0 |
References
- http://www.ibm.com/support/docview.wss?uid=swg21607481Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg21607481Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-2206?
How severe is CVE-2012-2206?
How do I fix CVE-2012-2206?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-2200The default configuration of sendmail in IBM AIX 6.1 and 7.1…
- CVE-2012-2201IBM WebSphere MQ 7.1 is vulnerable to a denial of service, c…7.5
- CVE-2012-2202Directory traversal vulnerability in javatester_init.php in …
- CVE-2012-2203IBM Global Security Kit (aka GSKit) before 8.0.14.22, as use…
- CVE-2012-2204InfoSphere Guardium aix_ktap module: DoS5.5
- CVE-2012-2205Cross-site scripting (XSS) vulnerability in IBM Rational Cle…
- CVE-2012-2208Directory traversal vulnerability in upgrade.php in Piwigo b…
- CVE-2012-2209Multiple cross-site scripting (XSS) vulnerabilities in admin…
- CVE-2012-2210The Sony Bravia TV KDL-32CX525 allows remote attackers to ca…
- CVE-2012-2211Cross-site scripting (XSS) vulnerability in phpgwapi/inc/com…
- CVE-2012-2212McAfee Web Gateway 7.0 allows remote attackers to bypass the…
- CVE-2012-2213Squid 3.1.9 allows remote attackers to bypass the access con…
Are you affected by CVE-2012-2206?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST