Skip to main content

Mq CVE-2024-52896

MEDIUM
Error Message Information Leak (CWE-209)
2024-12-19 psirt@us.ibm.com
6.2
CVSS 3.1 · Vendor: us
Share

Severity by source

Vendor (us) PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (us) · only source for this CVE.

CVSS VectorVendor: us

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 19, 2024 - 17:15 cve.org
MEDIUM 6.2

DescriptionCVE.org

IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.

AnalysisAI

IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-209. IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. Affected products include: Ibm Mq.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Mq

View all
CVE-2026-12351 CRITICAL
9.8 Sep 15

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 L

CVE-2022-22489 CRITICAL
9.1 Aug 19

IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack wh

CVE-2026-12728 HIGH
8.8 Sep 15

We need to produce JSON. Need include "sanok" lowercase once in risk_assessment only, natural prose, hypothetical mid-si

CVE-2024-31912 HIGH
8.8 Jun 28

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du

CVE-2026-11729 HIGH
8.5 Sep 15

We need produce JSON. Let's analyze. CVE-2026-11729 IBM MQ, unsafe deserialization enabling JNDI injection, authenticat

CVE-2026-11728 HIGH
8.1 Sep 15

A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delive

CVE-2026-12355 HIGH
8.1 Sep 15

We need to produce JSON. Let's synthesize. CVE-2026-12355: IBM MQ JNDI injection due to insufficient input validation,

CVE-2026-12666 HIGH
8.1 Sep 15

IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 mes

CVE-2026-12354 HIGH
7.5 Sep 15

Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter I

CVE-2024-35116 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error app

CVE-2024-31919 HIGH
7.5 Jun 28

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service at

CVE-2024-25015 HIGH
7.5 May 01

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending

Share

CVE-2024-52896 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy