CVE-2020-4682 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2020-4682

Analyzed

More Info Official Page

Source-psirt@us.ibm.com

Published At-28 Jan, 2021 | 13:15

Updated At-02 Feb, 2021 | 17:35

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

IBM Corporation

>>mq>>8.0.0.0

cpe:2.3:a:ibm:mq:8.0.0.0:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.1

cpe:2.3:a:ibm:mq:8.0.0.1:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.2

cpe:2.3:a:ibm:mq:8.0.0.2:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.3

cpe:2.3:a:ibm:mq:8.0.0.3:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.4

cpe:2.3:a:ibm:mq:8.0.0.4:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.5

cpe:2.3:a:ibm:mq:8.0.0.5:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.6

cpe:2.3:a:ibm:mq:8.0.0.6:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.7

cpe:2.3:a:ibm:mq:8.0.0.7:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.8

cpe:2.3:a:ibm:mq:8.0.0.8:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.9

cpe:2.3:a:ibm:mq:8.0.0.9:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.10

cpe:2.3:a:ibm:mq:8.0.0.10:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.11

cpe:2.3:a:ibm:mq:8.0.0.11:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.12

cpe:2.3:a:ibm:mq:8.0.0.12:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.13

cpe:2.3:a:ibm:mq:8.0.0.13:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.14

cpe:2.3:a:ibm:mq:8.0.0.14:*:*:*:*:*:*:*

IBM Corporation

>>mq>>8.0.0.15

cpe:2.3:a:ibm:mq:8.0.0.15:*:*:*:*:*:*:*

IBM Corporation

>>mq>>9.0.0.0

cpe:2.3:a:ibm:mq:9.0.0.0:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.1

cpe:2.3:a:ibm:mq:9.0.0.1:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.2

cpe:2.3:a:ibm:mq:9.0.0.2:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.3

cpe:2.3:a:ibm:mq:9.0.0.3:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.4

cpe:2.3:a:ibm:mq:9.0.0.4:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.5

cpe:2.3:a:ibm:mq:9.0.0.5:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.6

cpe:2.3:a:ibm:mq:9.0.0.6:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.7

cpe:2.3:a:ibm:mq:9.0.0.7:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.8

cpe:2.3:a:ibm:mq:9.0.0.8:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.9

cpe:2.3:a:ibm:mq:9.0.0.9:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.0.0.10

cpe:2.3:a:ibm:mq:9.0.0.10:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.0

cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.1

cpe:2.3:a:ibm:mq:9.1.0.1:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.2

cpe:2.3:a:ibm:mq:9.1.0.2:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.3

cpe:2.3:a:ibm:mq:9.1.0.3:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.4

cpe:2.3:a:ibm:mq:9.1.0.4:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.5

cpe:2.3:a:ibm:mq:9.1.0.5:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.1.0.6

cpe:2.3:a:ibm:mq:9.1.0.6:*:*:*:lts:*:*:*

IBM Corporation

>>mq>>9.2.0.0

cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:continuous_delivery:*:*:*

IBM Corporation

>>mq>>9.2.1.0

cpe:2.3:a:ibm:mq:9.2.1.0:*:*:*:continuous_delivery:*:*:*

IBM Corporation

>>mq_appliance>>9.2.0.0

cpe:2.3:a:ibm:mq_appliance:9.2.0.0:*:*:*:lts:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.0

cpe:2.3:a:ibm:websphere_mq:7.5.0.0:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.1

cpe:2.3:a:ibm:websphere_mq:7.5.0.1:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.2

cpe:2.3:a:ibm:websphere_mq:7.5.0.2:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.3

cpe:2.3:a:ibm:websphere_mq:7.5.0.3:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.4

cpe:2.3:a:ibm:websphere_mq:7.5.0.4:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.5

cpe:2.3:a:ibm:websphere_mq:7.5.0.5:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.6

cpe:2.3:a:ibm:websphere_mq:7.5.0.6:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.7

cpe:2.3:a:ibm:websphere_mq:7.5.0.7:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.8

cpe:2.3:a:ibm:websphere_mq:7.5.0.8:*:*:*:*:*:*:*

IBM Corporation

>>websphere_mq>>7.5.0.9

cpe:2.3:a:ibm:websphere_mq:7.5.0.9:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-502	Primary	nvd@nist.gov

CWE ID: CWE-502

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/186509	psirt@us.ibm.com	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6408626	psirt@us.ibm.com	Patch Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/186509

Source: psirt@us.ibm.com

Resource:

VDB Entry

Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/6408626

Source: psirt@us.ibm.com

Resource:

Patch

Vendor Advisory