10

CVE-2020-4682

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

Data is provided by the National Vulnerability Database (NVD)
Ibm ≫ Mq Version8.0.0.0
Ibm ≫ Mq Version8.0.0.1
Ibm ≫ Mq Version8.0.0.2
Ibm ≫ Mq Version8.0.0.3
Ibm ≫ Mq Version8.0.0.4
Ibm ≫ Mq Version8.0.0.5
Ibm ≫ Mq Version8.0.0.6
Ibm ≫ Mq Version8.0.0.7
Ibm ≫ Mq Version8.0.0.8
Ibm ≫ Mq Version8.0.0.9
Ibm ≫ Mq Version8.0.0.10
Ibm ≫ Mq Version8.0.0.11
Ibm ≫ Mq Version8.0.0.12
Ibm ≫ Mq Version8.0.0.13
Ibm ≫ Mq Version8.0.0.14
Ibm ≫ Mq Version8.0.0.15
Ibm ≫ Mq Version9.0.0.0 SwEditionlts
Ibm ≫ Mq Version9.0.0.1 SwEditionlts
Ibm ≫ Mq Version9.0.0.2 SwEditionlts
Ibm ≫ Mq Version9.0.0.3 SwEditionlts
Ibm ≫ Mq Version9.0.0.4 SwEditionlts
Ibm ≫ Mq Version9.0.0.5 SwEditionlts
Ibm ≫ Mq Version9.0.0.6 SwEditionlts
Ibm ≫ Mq Version9.0.0.7 SwEditionlts
Ibm ≫ Mq Version9.0.0.8 SwEditionlts
Ibm ≫ Mq Version9.0.0.9 SwEditionlts
Ibm ≫ Mq Version9.0.0.10 SwEditionlts
Ibm ≫ Mq Version9.1.0.0 SwEditionlts
Ibm ≫ Mq Version9.1.0.1 SwEditionlts
Ibm ≫ Mq Version9.1.0.2 SwEditionlts
Ibm ≫ Mq Version9.1.0.3 SwEditionlts
Ibm ≫ Mq Version9.1.0.4 SwEditionlts
Ibm ≫ Mq Version9.1.0.5 SwEditionlts
Ibm ≫ Mq Version9.1.0.6 SwEditionlts
Ibm ≫ Mq Version9.2.0.0 SwEditioncontinuous_delivery
Ibm ≫ Mq Version9.2.1.0 SwEditioncontinuous_delivery
Ibm ≫ Mq Appliance Version9.2.0.0 SwEditionlts
Ibm ≫ Websphere Mq Version7.5.0.0
Ibm ≫ Websphere Mq Version7.5.0.1
Ibm ≫ Websphere Mq Version7.5.0.2
Ibm ≫ Websphere Mq Version7.5.0.3
Ibm ≫ Websphere Mq Version7.5.0.4
Ibm ≫ Websphere Mq Version7.5.0.5
Ibm ≫ Websphere Mq Version7.5.0.6
Ibm ≫ Websphere Mq Version7.5.0.7
Ibm ≫ Websphere Mq Version7.5.0.8
Ibm ≫ Websphere Mq Version7.5.0.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.99% 0.853
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
psirt@us.ibm.com 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.