CVE-2020-4682: 
IBM WebSphere MQ vulnerability analysis and mitigation

CVE-2020-4682 is a vulnerability affecting IBM MQ versions 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD. The vulnerability was discovered and reported to IBM by Moritz Bechler, with the initial disclosure made on January 26, 2020. This security flaw exists within the IBM MQ Java and JMS client libraries, where an unsafe deserialization of trusted data could potentially allow remote code execution (IBM Support).

The vulnerability has been assigned a CVSS Base score of 8.1 with a vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The technical nature of the vulnerability involves unsafe deserialization of trusted data within the IBM MQ Java and JMS client libraries, which could be exploited to execute arbitrary code on the affected system (IBM Support).

If successfully exploited, this vulnerability would allow a remote attacker to execute arbitrary code on the affected system, potentially leading to complete system compromise. The high CVSS score reflects the severity of potential impact across confidentiality, integrity, and availability (IBM Support).

The vulnerability requires network access (AV:N) with high attack complexity (AC:H), requires no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U) with high impact potential across confidentiality, integrity, and availability (IBM Support).

IBM has released fixes for all affected versions: IBM WebSphere MQ 7.5 and IBM MQ 8.0 require applying interim fix for APAR IT33772, IBM MQ 9.0 LTS requires fix pack 9.0.0.11, IBM MQ 9.1 LTS requires fix pack 9.1.0.7, IBM MQ 9.2 LTS requires fix pack 9.2.0.1, and IBM MQ 9.2 CD users should upgrade to IBM MQ 9.2.1. No workarounds are available for this vulnerability (IBM Support).