VulnerabilityModified
CVE-2012-5953
IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service (infinite loop) via a crafted query…
MEDIUM 4.3EPSS 1.32%
Does this matter?
Lower severity and a low EPSS score (1.32%). Track it; it rarely justifies an emergency change on its own.
Description
IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service (infinite loop) via a crafted query string.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- ibm/websphere message broker
- Source
- psirt@us.ibm.com
References
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM75015
- http://www-01.ibm.com/support/docview.wss?uid=swg21623316Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80667
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM75015
- http://www-01.ibm.com/support/docview.wss?uid=swg21623316Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80667
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.