{"id":"CVE-2023-26284","aliases":["EUVD-2023-30107","GHSA-gqpw-g738-c6vx"],"status":"published","title":"IBM MQ Certified Container improper access controls","description":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls.  IBM X-Force ID:  248417.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00746,"percentile":0.55265,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2023-03-15T17:26:21Z","modified":"2026-06-17T05:42:58Z","products":[{"vendor":"ibm","product":"mq certified container"},{"vendor":"ibm","product":"mq_certified_container"}],"references":[{"url":"https://www.ibm.com/support/pages/node/6960201","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/248417","tags":["vdb-entry","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26284"},{"url":"https://github.com/advisories/GHSA-gqpw-g738-c6vx"}],"sources":{"cve":[{"id":"CVE-2023-26284","title":"IBM MQ Certified Container improper access controls","description":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls.  IBM X-Force ID:  248417.","status":"published","published":"2023-03-15T17:26:21.136Z","modified":"2025-02-26T21:16:33.24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-30107","description":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls.  IBM X-Force ID:  248417.","status":"published","published":"2023-03-15T17:26:21Z","modified":"2025-02-26T21:16:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:22.427611Z"}],"ghsa":[{"id":"GHSA-gqpw-g738-c6vx","title":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow...","description":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls. IBM X-Force ID: 248417.","status":"published","published":"2023-03-15T18:30:22Z","modified":"2023-03-28T05:09:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:54:24.674255Z"}],"nvd":[{"id":"CVE-2023-26284","description":"IBM MQ Certified Container 9.3.0.1 through 9.3.0.3 and 9.3.1.0 through 9.3.1.1 could allow authenticated users with the cluster to be granted administration access to the MQ console due to improper access controls.  IBM X-Force ID:  248417.","status":"published","published":"2023-03-15T18:15:10.703Z","modified":"2026-06-17T05:42:58.983Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:49.031498Z"}]}}