CVE-2020-4319

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-28 · updated 2026-06-17
Weakness: CWE-209

Description

IBM MQ, IBM MQ Appliance, and IBM MQ for HPE NonStop 8.0, 9.1 LTS, and 9.1 CD could allow under special circumstances, an authenticated user to obtain sensitive information due to a data leak from an error message within the pre-v7 pubsub logic. IBM X-Force ID: 177402.

Affected products

IBM MQ Appliance: from 8.0 before 8.0.0.15; from 9.1.0.0 before 9.1.0.6; from 9.1.0.0 before 9.2.0.0 — fixed in 8.0.0.15, 9.1.0.6, 9.2.0.0

How to fix

Upgrade to a fixed version: IBM MQ Appliance 8.0.0.15, 9.1.0.6, 9.2.0.0. Check the vendor advisory for mitigations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/177402
https://www.ibm.com/support/pages/node/6252777
https://exchange.xforce.ibmcloud.com/vulnerabilities/177402
https://www.ibm.com/support/pages/node/6252777

Get alerted when CVE-2020-4319 or the next vulnerability affects your stack