TI-2020-03721 Aliases CVE-2020-4319 GHSA-r542-g4pm-8f6m

Information disclosure through error messages in IBM MQ Appliance

LOW 21CWE-209Published 2020-07-28 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-209.

Summary

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.

Why it matters now

EPSS 0.00748 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	MQ Appliance	8.0; 9.1.LTS; 9.1.CD	—	No fix listed	CNA

MQ Appliance VendorIBM Affected 8.0; 9.1.LTS; 9.1.CD Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:mq_appliance::::::::	8.0 to before 8.0.0.15	Vulnerable	IBM
cpe:2.3:a:ibm:mq_appliance:::::lts:::*	9.1.0.0 to before 9.1.0.6	Vulnerable	IBM
cpe:2.3:a:ibm:mq_appliance:::::continuous_delivery:::*	9.1.0.0 to before 9.2.0.0	Vulnerable	IBM

cpe:2.3:a:ibm:mq_appliance:*:*:*:*:*:*:*:* Versions 8.0 to before 8.0.0.15 Vulnerable ·IBM
cpe:2.3:a:ibm:mq_appliance:*:*:*:*:lts:*:*:* Versions 9.1.0.0 to before 9.1.0.6 Vulnerable ·IBM
cpe:2.3:a:ibm:mq_appliance:*:*:*:*:continuous_delivery:*:*:* Versions 9.1.0.0 to before 9.2.0.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-4319
2026-10-03 Alias added: GHSA-r542-g4pm-8f6m

References

Patch 1

https://www.ibm.com/support/pages/node/6252777

TI-2020-03985 Deserialization of untrusted data in IBM MQ CVSS 3.1CRITICAL 9.8
TI-2017-01080 OS command injection in IBM MQ Appliance CVSS 3.0HIGH 8.8
TI-2025-00826 IBM MQ code execution CVSS 3.1HIGH 8.8
TI-2023-11446 IBM MQ denial of service CVSS 3.1HIGH 7.5
TI-2020-04160 Cross-site request forgery in IBM MQ Appliance CVSS 3.1HIGH 8.8
TI-2024-16522 IBM MQ code execution CVSS 3.1HIGH 7.5

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences