CVE-2020-4938
published 2021-07-12CVE-2020-4938: IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
PriorityP337high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.40%
31.9th percentile
IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | mq_appliance | — | — |
| ibm | mq_appliance | — | — |
| ibm | mq_appliance | >= 9.1 < 9.2.2 | 9.2.2 |
| ibm | mq_appliance | >= 9.1.0.0 < 9.1.0.8 | 9.1.0.8 |
| ibm | mq_appliance | >= 9.2.0.0 < 9.2.0.2 | 9.2.0.2 |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_office_2010_service_pack_2 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_word_2010_service_pack_2 | — | — |
| msrc | microsoft_word_2013_rt_service_pack_1 | — | — |
| msrc | microsoft_word_2013_service_pack_1 | — | — |
| msrc | microsoft_word_2016 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_msrc3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vvf5-hc5m-grm8: IBM MQ Appliance 9
ghsa_unreviewed·2022-05-24
CVE-2020-4938 [HIGH] CWE-352 GHSA-vvf5-hc5m-grm8: IBM MQ Appliance 9
IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191815.
Microsoft
Microsoft Word Security Feature Bypass Vulnerability
vendor_msrc·2020-11-10·CVSS 3.3
CVE-2020-17020 [LOW] Microsoft Word Security Feature Bypass Vulnerability
Microsoft Word Security Feature Bypass Vulnerability
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
Microsoft Office: Microsoft Office
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Remediation: Click to Run
Reference: https://www.microsoft.com/download/details.aspx?familyid=af00e20b-3992-43a5-b2ad-3fd9bb018bc5
Reference: https://www.microsoft.com/download/details.aspx?familyid=7c42ef03-4cad-4897-9336-1be5d0b48678
Reference: https://www.microsoft.com/download/details.aspx?familyid=33fa0817-53a2-4938-8e74-fb6fa2d44911
Reference
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-07-12
Published