VULNERABILITY INTELLIGENCE

CVE-2015-5011

CVSS score3.2 LOW
EPSS probability0.33%
CISA KEVNot currently listed
Published2015-10-26
Last modified2026-06-17
CVSS vectorAV:L/AC:L/Au:S/C:N/I:P/A:P

Description

IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands, which allows local users to bypass intended access restrictions, and start or stop a service, by issuing a command.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references