IBM CICS TX information disclosure

Vulnerability

IBM CICS TX Advanced 11.1 and IBM CICS TX Standard 11.1 use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information [1], [2]. The vulnerability affects all versions of CICS TX Standard and specifically version 11.1 of CICS TX Advanced [1], [2]. IBM X-Force ID: 229464.

Exploitation

An attacker can exploit this vulnerability over the network with no authentication required and no user interaction [1], [2]. The attack complexity is high, meaning successful exploitation requires significant effort or specific conditions [1], [2]. There is no need for privileges or write access to the system.

Impact

Successful exploitation results in the decryption of highly sensitive information, leading to a high loss of confidentiality [1], [2]. Integrity and availability are not affected. The scope of the compromise remains unchanged, and the attacker gains no additional privileges beyond the decrypted data.

Mitigation

IBM has released interim fixes for both CICS TX Advanced (defect 127926) and CICS TX Standard (defect 127926) on their support portal [1], [2]. No workarounds or mitigations are available; applying the fix is required [1], [2].