Security readout for executives and security teams
Plain-English summary
This is a local privilege escalation in IBM MQ/WebSphere MQ. A non-administrative user with local access could potentially run code with administrator rights because MQ installation directories had incorrect permissions. The main business risk is loss of control over systems that host MQ.
Executive priority
Treat as high priority where IBM MQ supports critical business workflows or runs on shared systems. This is not a remote internet-entry issue based on the bundle, but it can amplify a foothold into administrator control.
Technical view
CVE-2019-4078 affects IBM MQ/WebSphere MQ versions listed in the bundle, including 8.0.0.0 through 8.0.0.9 and 9.0.0.0 through 9.1.1. The flaw is incorrect permissions on MQ installation directories, enabling local code execution as administrator. CVSS 3.0 score is 7.4 high, with local attack vector and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on servers or workstations running the affected IBM MQ/WebSphere MQ versions where unprivileged local users, service accounts, or compromised low-privilege accounts can access the host.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector marks exploit code maturity as unproven. Risk still matters because successful exploitation could convert local access into administrator-level control on MQ hosts.
Researcher notes
Evidence points to a local privilege escalation caused by incorrect installation-directory permissions. The bundle has a minor version-range inconsistency: the title says 8.0.0.0 through 8.0.0.9, while the affected list also includes 8.0.0.10 and 8.0.0.11. Validate final scope against IBM's bulletin.
Mitigation direction
- Inventory IBM MQ/WebSphere MQ hosts and map installed versions to the affected ranges.
- Review IBM advisory ibm10872876 and apply the vendor-recommended fix or remediation.
- Restrict local interactive and service-account access on MQ hosts until remediated.
- Review MQ installation directory permissions for deviations from IBM-supported settings.
- Prioritize internet-adjacent, shared, or high-trust MQ infrastructure first.
Validation and detection
- Confirm installed MQ version on each host against IBM's affected-version guidance.
- Check MQ installation directory ownership and permissions for excessive write access.
- Verify remediation by confirming IBM-supported fixed level or advisory-directed configuration.
- Review local user and service-account membership on MQ servers.
- Monitor privileged account creation or unexpected changes on MQ hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-4078 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/I:H/S:U/UI:N/C:H/A:H/AV:L/AC:H/PR:N/RC:C/RL:O/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/I:H/S:U/UI:N/C:H/A:H/AV:L/AC:H/PR:N/RC:C/RL:O/E:U1.45.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.4HighVector: CVSS:3.0/I:H/S:U/UI:N/C:H/A:H/AV:L/AC:H/PR:N/RC:C/RL:O/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/docview.wss?uid=ibm10872876CVE reference · x_refsource_CONFIRM
- ibm-websphere-cve20194078-priv-escalation (157190)CVE reference · vdb-entry, x_refsource_XF
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.