## Summary

IBM MQ has resolved multiple Angular JS vulnerabilities (CVE-2022-25844, CVE-2023-26116, CVE-2023-26117, CVE-2023-26118, CVE-2022-25869). Angular JS is used in Dashboard Web Console.

## Vulnerability Details

**CVEID: **[CVE-2022-25844]()
**DESCRIPTION: **Node.js Angular module is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in posPre: ‘ ‘.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre. By sending a specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/225115]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

**CVEID: **[CVE-2023-26116]()
**DESCRIPTION: **AngularJS is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the angular.copy() utility function. By providing specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/251497]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

**CVEID: **[CVE-2023-26117]()
**DESCRIPTION: **AngularJS is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the $resource service. By providing specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/251496]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

**CVEID: **[CVE-2023-26118]()
**DESCRIPTION: **AngularJS is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the input[url] functionality. By providing specially-crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/251494]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

**CVEID: **[CVE-2022-25869]()
**DESCRIPTION: **Node.js angular module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input when caching pages using Internet Explorer. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 4.2
CVSS Temporal Score: See: [ https://exchange.xforce.ibmcloud.com/vulnerabilities/231374]() for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

## Affected Products and Versions

Affected Product(s) | Version(s)
—|—
IBM MQ | 9.0 LTS
IBM MQ | 9.1 LTS
IBM MQ | 9.2 LTS
IBM MQ | 9.2 CD

The following installable MQ components are affected by the vulnerability:

– REST API and Console

If you are running any of these listed components, please apply the remediation/fixes as described below. For more information on the definitions of components used in this list see

## Remediation/Fixes

**IBM MQ 9.0 LTS**

[Upgrade to IBM MQ 9.3.0](), or later

**IBM MQ 9.1 LTS**

[Upgrade to IBM MQ 9.3.0](), or later

**IBM MQ 9.2 LTS**

[Upgrade to IBM MQ 9.3.0](), or later

**IBM MQ 9.2 CD **

[Upgrade to IBM MQ 9.3.0](), or later

## Workarounds and Mitigations

If not ready to upgrade to IBM MQ 9.3, the best mitigation is to uninstall the MQ Console component.

If requiring the MQ Console capability the New Web Console (which is the default web console for IBM MQ 9.2) is not vulnerable. For instructions on switching from Dashboard Web Console to New Web Console see .

Alternatively, the IBM MQ 9.3 Console can be used with IBM MQ 9.0, IBM MQ 9.1 or IBM MQ 9.2 queue managers – either installed alongside the existing installation, or using a remote connection on a separate host (REST Messaging API for remote connections requires at least IBM MQ 9.3.3 CD).

##Read More