CVE-2024-25015

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-406

Affected software

Vendor	Product	Versions
IBM	MQ	9.2 LTS, 9.3 LTS, 9.3 CD
ibm	mq	9.2 LTS; 9.3 LTS; 9.3 CD

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/281278Vendor Advisory
https://www.ibm.com/support/pages/node/7149583Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/281278Vendor Advisory
https://www.ibm.com/support/pages/node/7149583Vendor Advisory

Timeline

Published: May 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-250167.5IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due CVE-2024-250199.8IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journa CVE-2024-25022.0An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This CVE-2024-250209.8IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments i CVE-2024-250218.4IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands CVE-2024-250235.5IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive CVE-2024-250245.5IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in p CVE-2024-250267.5IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial CVE-2024-250275.5IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.CVE-2024-2502910.0IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution (RCE) and local pri CVE-2024-25035.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid Widget in all version CVE-2024-250305.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be r