CVE-2023-28513

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.3 CD and IBM MQ Appliance 9.2 LTS, 9.3 LTS, 9.2 CD, and 9.2 LTS, under certain configurations, is vulnerable to a denial of service attack caused by an error processing messages. IBM X-Force ID: 250397.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
IBM	MQ	9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.2 CD, 9.3 CD
IBM	MQ Appliance	9.2 LTS, 9.3 LTS, 9.2 CD, 9.2 LTS

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/250397VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7007421Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/7007731Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/250397VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7007421Patch, Vendor Advisory
https://www.ibm.com/support/pages/node/7007731Patch, Vendor Advisory

Timeline

Published: Jul 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-285145.5IBM MQ 8.0, 9.0, and 9.1 could allow a local user to obtain sensitive credential information when a detailed technical error message is retu CVE-2023-285175.4IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to em CVE-2023-28529.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Softmed SelfPatron allows SQL Injectio CVE-2023-285205.4IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript CVE-2023-285228.8IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585.CVE-2023-285237.8IBM Informix Dynamic Server 12.10 and 14.10 onsmsync is vulnerable to a heap buffer overflow, caused by improper bounds checking which could CVE-2023-285254.8IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja CVE-2023-285265.5IBM Informix Dynamic Server 12.10 and 14.10 archecker is vulnerable to a heap buffer overflow, caused by improper bounds checking which coul CVE-2023-285275.5IBM Informix Dynamic Server 12.10 and 14.10 cdr is vulnerable to a heap buffer overflow, caused by improper bounds checking which could allo CVE-2023-285287.8IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute ar CVE-2023-285295.4IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2023-28536.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softmed SelfPatron allows Reflected XS