IBM WebSphere Mq Internet Pass Thru vulnerabilities

2 CVEs affecting IBM WebSphere Mq Internet Pass Thru, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-0173, published 2015-06-28.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-0173, published 2015-06-28. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it…
• CVE-2013-5401, published 2014-03-21. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The command-port listener in IBM WebSphere MQ Internet Pass-Thru (MQIPT) 2.x before 2.1.0.1 allows remote attackers to cause a denial of service (remote-administration outage) via unspecified vectors.