CVE-2012-2206 describes an insufficient access control vulnerability in the Web Gateway component of IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier. Authenticated remote attackers can exploit this flaw to read arbitrary user files by manipulating the username in a URI, specifically through the /transfer URI with a modified metadata=fteSamplesUser field. This vulnerability has a CVSS score of 3.5, indicating a medium attack complexity and requiring authentication, but only allows for partial confidentiality impact without affecting integrity or availability. While not actively exploited in the wild or on the CISA KEV catalog, an ExploitDB entry (EDB-20478) exists, and there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_mq:7.0:*:file_transfer:*:*:*:*:* | ||
7.0.0.1CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_mq:7.0.0.1:*:file_transfer:*:*:*:*:* | ||
7.0.1.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_mq:7.0.1.0:*:file_transfer:*:*:*:*:* | ||
7.0.2.0CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_mq:7.0.2.0:*:file_transfer:*:*:*:*:* | ||
7.0.2.2CPE matchmatch criteria | cpe:2.3:a:ibm:websphere_mq:7.0.2.2:*:file_transfer:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:S/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.