Werk #16615: Remove websphere_mq plugin

Component Checks & agents
Title Remove websphere_mq plugin
Date Mar 11, 2024
Checkmk Edition Checkmk Raw (CRE)
Checkmk Version 2.2.0p26 2.3.0b5 2.4.0b1
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

With this Werk the websphere_mq plugin is removed for security reasons.

In this plugin the output of ps is used to determine an argument for runmqsc. This meant that anybody who can launch processes with an arbitrary command line could manipulate one argument to runmqsc.

The plugin was already superseded by the agent plugin ibm_mq and deprecated with Werk 10752 and version 2.0.0.

Since this plugin is already deprecated and it was not configurable via the agent bakery we assumed that this plugin is not frequently used. Therefore we decided to not fix the issue but to push the removal.

We found this vulnerability internally.

Affected versions:

  • 2.3.0
  • 2.2.0
  • 2.1.0
  • 2.0.0


Migrate to the ibm_mq plugin.

Vulnerability Management:

We have rated the issue with a CVSS Score of 6.5 (Medium) with the following CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. We assigned CVE-2024-3367 to this vulnerability.


The plugin was removed.

To the list of all Werks