{"id":"CVE-2024-27255","state":"PUBLISHED","title":"IBM MQ Container information disclosure","description":"IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  283905.","publishedAt":"2024-03-03T11:54:10.301Z","updatedAt":"2024-08-02T00:27:59.999Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"ibm"},"assigner":"ibm","products":["IBM MQ Operator"],"affected":[{"vendor":"IBM","product":"MQ Operator","defaultStatus":"unaffected","versions":[{"version":"2.0.0 LTS","status":"affected","lessThanOrEqual":"2.0.18 LTS","versionType":"semver"},{"version":"2.4.0","status":"affected","lessThanOrEqual":"2.4.7","versionType":"semver"},{"version":"2.3.0","status":"affected","lessThanOrEqual":"2.3.3","versionType":"semver"},{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.2.2","versionType":"semver"},{"version":"3.0.0 CD","status":"affected","lessThanOrEqual":"3.0.1 CD","versionType":"semver"}]}],"references":["https://www.ibm.com/support/pages/node/7126571","https://exchange.xforce.ibmcloud.com/vulnerabilities/283905"],"weaknesses":["CWE-327"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/27xxx/CVE-2024-27255.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-27255","state":"PUBLISHED","datePublished":"2024-03-03T11:54:10.301Z","dateUpdated":"2024-08-02T00:27:59.999Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2024-02-22T01:26:15.968Z"},"containers":{"cna":{"title":"IBM MQ Container information disclosure","descriptions":[{"lang":"en","value":"IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.  IBM X-Force ID:  283905."}],"affected":[{"vendor":"IBM","product":"MQ Operator","defaultStatus":"unaffected","versions":[{"version":"2.0.0 LTS","status":"affected","lessThanOrEqual":"2.0.18 LTS","versionType":"semver"},{"version":"2.4.0","status":"affected","lessThanOrEqual":"2.4.7","versionType":"semver"},{"version":"2.3.0","status":"affected","lessThanOrEqual":"2.3.3","versionType":"semver"},{"version":"2.2.0","status":"affected","lessThanOrEqual":"2.2.2","versionType":"semver"},{"version":"3.0.0 CD","status":"affected","lessThanOrEqual":"3.0.1 CD","versionType":"semver"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7126571","tags":["vendor-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/283905","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-327","description":"CWE-327 Use of a Broken or Risky Cryptographic Algorithm","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2024-03-03T11:54:10.301Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-12T21:55:16.267865Z","id":"CVE-2024-27255","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-12T21:55:47.957Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.ibm.com/support/pages/node/7126571","tags":["vendor-advisory","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/283905","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:27:59.999Z"}}]}}}