{"api_version":"1","generated_at":"2026-07-23T14:48:13+00:00","cve":"CVE-2022-40230","urls":{"html":"https://cve.report/CVE-2022-40230","api":"https://cve.report/api/cve/CVE-2022-40230.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-40230","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-40230"},"summary":{"title":"CVE-2022-40230","description":"\"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532.\"","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2022-11-03 20:15:00","updated_at":"2022-11-04 17:14:00"},"problem_types":["CWE-613"],"metrics":[],"references":[{"url":"https://www.ibm.com/support/pages/node/6622051","name":"https://www.ibm.com/support/pages/node/6622051","refsource":"MISC","tags":[],"title":"Security Bulletin: IBM MQ Appliance is vulnerable to improper session invalidation (CVE-2022-40230)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40230","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40230","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"40230","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"mq_appliance","cpe6":"9.2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"continuous_delivery","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"40230","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"mq_appliance","cpe6":"9.2.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"40230","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"mq_appliance","cpe6":"9.3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"continuous_delivery","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"40230","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"mq_appliance","cpe6":"9.3.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"lts","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-40230","ASSIGNER":"psirt@us.ibm.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"\"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 235532.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Session Fixation"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"IBM MQ Appliance ","version":{"version_data":[{"version_value":"\"9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3\"","version_affected":"="}]}}]}}]}},"references":{"reference_data":[{"url":"https://www.ibm.com/support/pages/node/6622051","refsource":"MISC","name":"https://www.ibm.com/support/pages/node/6622051"}]}},"nvd":{"publishedDate":"2022-11-03 20:15:00","lastModifiedDate":"2022-11-04 17:14:00","problem_types":["CWE-613"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:lts:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:continuous_delivery:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:mq_appliance:9.3.0.0:*:*:*:lts:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:mq_appliance:9.3.0.0:*:*:*:continuous_delivery:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}