{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-27256","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","state":"PUBLISHED","assignerShortName":"ibm","dateReserved":"2024-02-22T01:26:15.968Z","datePublished":"2025-01-27T16:27:53.275Z","dateUpdated":"2025-02-18T19:29:12.435Z"},"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:mq_operator:3.0.0:*:*:*:continuous_delivery:*:*:*","cpe:2.3:a:ibm:mq_operator:3.0.1:*:*:*:continuous_delivery:*:*:*","cpe:2.3:a:ibm:mq_operator:3.1.0:*:*:*:continuous_delivery:*:*:*","cpe:2.3:a:ibm:mq_operator:3.1.3:*:*:*:continuous_delivery:*:*:*","cpe:2.3:a:ibm:mq_operator:2.0.0:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq_operator:2.0.22:*:*:*:lts:*:*:*","cpe:2.3:a:ibm:mq_operator:2.2.0:*:*:*:-:*:*:*","cpe:2.3:a:ibm:mq_operator:2.2.2:*:*:*:-:*:*:*","cpe:2.3:a:ibm:mq_operator:2.3.0:*:*:*:-:*:*:*","cpe:2.3:a:ibm:mq_operator:2.3.3:*:*:*:-:*:*:*","cpe:2.3:a:ibm:mq_operator:2.4.0:*:*:*:-:*:*:*","cpe:2.3:a:ibm:mq_operator:2.4.8:*:*:*:-:*:*:*"],"defaultStatus":"unaffected","product":"MQ Operator","vendor":"IBM","versions":[{"lessThanOrEqual":"2.4.8","status":"affected","version":"2.4.0","versionType":"semver"},{"lessThanOrEqual":"2.3.3","status":"affected","version":"2.3.0","versionType":"semver"},{"lessThanOrEqual":"2.2.2","status":"affected","version":"2.2.0","versionType":"semver"},{"lessThanOrEqual":"2.0.22 LTS","status":"affected","version":"2.0.0 LTS","versionType":"semver"},{"status":"affected","version":"3.0.0 CD, 3.0.1 CD"},{"lessThanOrEqual":"3.1.3 CD","status":"affected","version":"3.1.0 CD","versionType":"semver"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}],"value":"IBM MQ Container 3.0.0, 3.0.1, 3.1.0 through 3.1.3 CD, 2.0.0 LTS through 2.0.22 LTS and 2.4.0 through 2.4.8, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-327","description":"CWE-327 Use of a Broken or Risky Cryptographic Algorithm","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2025-01-27T16:27:53.275Z"},"references":[{"url":"https://www.ibm.com/support/pages/node/7157667"}],"source":{"discovery":"UNKNOWN"},"title":"IBM MQ Operator information disclosure","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-27T16:38:52.951975Z","id":"CVE-2024-27256","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-18T19:29:12.435Z"}}]}}