IBM4C09598B2AB18F2AA5E848F624CF012DA021DD4C74EE859E0D0FA652FD29CEA6Security Bulletin: IBM MQ Console and REST API could expose sensitive information to an attacker. (CVE-2019-4441)
EPSS
Percentile
42.1%
Summary
IBM WebSphere Application Server Liberty profile, which is used to host the IBM MQ Console and REST API, could allow a remote attacker to obtain sensitive information.
Vulnerability Details
CVEID:CVE-2019-4441
**DESCRIPTION:**IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 163177.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/163177 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM MQ Appliance | 8.0 |
| IBM MQ and IBM MQ Appliance | 9.1 LTS |
| IBM MQ and IBM MQ Appliance | 9.1 CD |
Remediation/Fixes
IBM MQ Appliance V8
IBM MQ and IBM MQ Appliance V9.1 LTS
Apply FixPack 9.1.0.4
IBM MQ and IBM MQ Appliance V9.1 CD
Upgrade to IBM MQ 9.1.4
Workarounds and Mitigations
None
Related
EPSS
Percentile
42.1%