CVE-2012-3317

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-12-05 · updated 2026-06-16
Weakness: CWE-264

Description

IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.

Affected products

IBM WebSphere Message Broker: 6.1, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.0.4, 6.1.0.5 (+12)

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IC85477
http://www.ibm.com/support/docview.wss?uid=swg21611401
https://exchange.xforce.ibmcloud.com/vulnerabilities/77818
http://www-01.ibm.com/support/docview.wss?uid=swg1IC85477
http://www.ibm.com/support/docview.wss?uid=swg21611401
https://exchange.xforce.ibmcloud.com/vulnerabilities/77818

Get alerted when CVE-2012-3317 or the next vulnerability affects your stack