CVE-2020-4682

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe…

8.1HighCVSS base score
7.6%Exploitation in 30 daysEPSS · top 5.4% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.

Timeline

2019
30 Dec 2019
30 Dec 2019
ID reserved
By ibm
2021
28 Jan 202113 months later
28 Jan 2021· 13 months later
Published
2024
16 Sept 20244 years later
16 Sept 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-4682, by who scored it
Scored by	CVSS	Score	Vector
ibmCNA (assigner)	3.0	High8.1	CVSS:3.0/AC:H/I:H/S:U/C:H/UI:N/A:H/AV:N/PR:N/RL:O/RC:C/E:U
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 7.6% · top 5.4% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.

Affected products

IBM · MQ
- affected 8.0.0
- affected 9.0.0
- affected 9.1.0
- affected 7.5.0
- affected 9.2.0

References2

https://www.ibm.com/support/pages/node/6408626 (opens in a new tab)x_refsource_CONFIRMx_transferred
ibm-mq-cve20204682-code-exec (186509) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-4682](https://cveledger.app/badge/CVE-2020-4682.svg)](https://cveledger.app/cve/CVE-2020-4682)

Record last updated 16 Sept 2024, 19:04 UTC.