CVE-2020-4338: 
IBM WebSphere MQ vulnerability analysis and mitigation

IBM MQ and IBM MQ Appliance version 9.1 CD contained a vulnerability (CVE-2020-4338) that could allow a local attacker to obtain sensitive information. This vulnerability was identified as an incomplete fix for a previous issue (CVE-2019-4719) and was disclosed on April 7, 2020. The vulnerability specifically affects the runmqras data functionality in IBM MQ systems (IBM Security).

The vulnerability has a CVSS Base score of 5.1 with a vector of CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates a local attack vector with high attack complexity, no privileges required, no user interaction needed, and potential for high confidentiality impact. The technical issue involves the inclusion of sensitive data within runmqras data, which could potentially expose sensitive information to attackers (IBM Security).

The vulnerability could allow local attackers to obtain sensitive information through the exposure of sensitive data within runmqras data. The impact is primarily focused on confidentiality, with no direct impact on system integrity or availability (IBM Security).

The vulnerability requires local access to the system and has high attack complexity. While specific exploit details are not publicly available, the attack vector is limited to local access, which somewhat reduces the risk of widespread exploitation (IBM Security).

IBM has released version 9.1.5 as a fix for affected systems running IBM MQ and IBM MQ Appliance V9.1 CD. As a workaround, users are advised to avoid using the -ftppassword parameter to runmqras. It's worth noting that other versions affected by the original CVE-2019-4719 issue are not affected by this specific vulnerability (IBM Security).