Read the docs
TI-2015-00109 Aliases CVE-2015-0118GHSA-5mrw-gf6v-xxgp

IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and…

Priority LOW 22CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.

Why it matters now

EPSS 0.01066 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ibm:websphere_message_broker:7.0.:*:*:*:*:*:*:*7.0.VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:7.0.0.1:*:*:*:*:*:*:*7.0.0.1VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:7.0.0.2:*:*:*:*:*:*:*7.0.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:7.0.0.3:*:*:*:*:*:*:*7.0.0.3VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:7.0.0.4:*:*:*:*:*:*:*7.0.0.4VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:7.0.0.5:*:*:*:*:*:*:*7.0.0.5VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:*8.0VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:*:*:*:*:*:*:*8.0.0.1VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:*:*:*:*:*:*:*8.0.0.2VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:*:*:*:*:*:*:*8.0.0.3VulnerableIBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.:*:*:*:*:*:*:* Versions 7.0. Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.0.1:*:*:*:*:*:*:* Versions 7.0.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.0.2:*:*:*:*:*:*:* Versions 7.0.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.0.3:*:*:*:*:*:*:* Versions 7.0.0.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.0.4:*:*:*:*:*:*:* Versions 7.0.0.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:7.0.0.5:*:*:*:*:*:*:* Versions 7.0.0.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:*:*:*:*:*:*:* Versions 8.0.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:*:*:*:*:*:*:* Versions 8.0.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:*:*:*:*:*:*:* Versions 8.0.0.3 Vulnerable ·IBM
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.4:*:*:*:*:*:*:*8.0.0.4VulnerableIBM
cpe:2.3:a:ibm:websphere_message_broker:8.0.0.5:*:*:*:*:*:*:*8.0.0.5VulnerableIBM
cpe:2.3:a:ibm:integration_bus:9.0:*:*:*:*:*:*:*9.0VulnerableIBM
cpe:2.3:a:ibm:integration_bus:9.0.0.1:*:*:*:*:*:*:*9.0.0.1VulnerableIBM
cpe:2.3:a:ibm:integration_bus:9.0.0.2:*:*:*:*:*:*:*9.0.0.2VulnerableIBM
cpe:2.3:a:ibm:integration_bus:9.0.0.3:*:*:*:*:*:*:*9.0.0.3VulnerableIBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0.0.4:*:*:*:*:*:*:* Versions 8.0.0.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:websphere_message_broker:8.0.0.5:*:*:*:*:*:*:* Versions 8.0.0.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:integration_bus:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:integration_bus:9.0.0.1:*:*:*:*:*:*:* Versions 9.0.0.1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:integration_bus:9.0.0.2:*:*:*:*:*:*:* Versions 9.0.0.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:integration_bus:9.0.0.3:*:*:*:*:*:*:* Versions 9.0.0.3 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-0118
  2. 2026-10-03 Alias added: GHSA-5mrw-gf6v-xxgp

References

Advisory 2

  • TI-2016-07877 XML external entity injection in IBM Integration Bus CVSS 3.0CRITICAL 9.1
  • TI-2025-24634 IBM Integration Bus for z/OS code injection CVSS 3.1HIGH 8.2
  • TI-2017-01324 Cleartext transmission of sensitive information in IBM Integration Bus CVSS 3.0HIGH 8.1
  • TI-2024-14913 IBM Integration Bus for z/OS denial of service CVSS 3.1MEDIUM 6.5
  • TI-2018-01590 XML external entity injection in IBM Integration Bus CVSS 3.0MEDIUM 5.3
  • TI-2016-07377 IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the… CVSS 3.0MEDIUM 6.1
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences