PT-2020-17999 · Ibm · Ibm Mq+2

Published 2020-07-28 · Updated 2021-07-21 · CVE-2020-4319

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM MQ versions 8.0 through 9.1 IBM MQ Appliance versions 8.0 through 9.1 IBM MQ for HPE NonStop versions 8.0 through 9.1

Description The issue allows an authenticated user to obtain sensitive information under special circumstances due to a data leak from an error message within the pre-v7 pubsub logic.

Recommendations For IBM MQ versions 8.0 through 9.1, update to a version that includes the fix for this issue. For IBM MQ Appliance versions 8.0 through 9.1, update to a version that includes the fix for this issue. For IBM MQ for HPE NonStop versions 8.0 through 9.1, update to a version that includes the fix for this issue.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2020-4319

Affected Products

Ibm Mq

Ibm Mq Appliance

Ibm Mq For Hpe Nonstop

References · 4

• https://ibm.com/support/pages/node/6252777 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/177402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4319 · Security Note
• https://osv.dev/vulnerability/CVE-2020-4319 · Vendor Advisory