LiveActive security incident?Get immediate response
CVE Record

CVE-2020-4289: IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote att...

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 176332.

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

IBM Security Information Queue versions 1.0.0 through 1.0.5 may expose sensitive cookie information because the HTTPOnly cookie flag is not set. This is a medium-severity issue: it affects confidentiality, but the provided sources do not indicate system takeover, data modification, service outage, or known active exploitation.

Executive priority

Handle as a targeted remediation item, not an emergency. Prioritize if ISIQ is internet-facing, used with sensitive workflows, or difficult to monitor. The business risk is unauthorized exposure of cookie-contained information, with no provided evidence of active exploitation.

Technical view

CVE-2020-4289 is a remotely reachable information disclosure flaw in IBM Security Information Queue. The published CVSS 3.0 score is 5.3, with network attack vector, low complexity, no privileges, no user interaction, and low confidentiality impact. The described root cause is failure to set the HTTPOnly flag on a cookie.

Likely exposure

Exposure is limited to organizations running IBM Security Information Queue 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, or 1.0.5. The bundle does not identify affected deployment modes, public exposure frequency, or downstream products.

Exploitation context

The sources describe a remote attacker obtaining sensitive information from a cookie. CISA KEV is false in the bundle, and no cited source states active exploitation. Treat exploitation status as unconfirmed, not active.

Researcher notes

The source bundle does not include CWE mapping, exploit proof, exact cookie names, affected endpoints, or fixed version details. Analysis should remain scoped to IBM Security Information Queue 1.0.0-1.0.5 and the missing HTTPOnly flag condition.

Mitigation direction

  • Check IBM advisory for the official fix or supported upgrade path.
  • Upgrade or apply IBM remediation if your ISIQ version is listed affected.
  • Verify affected cookies set the HTTPOnly flag after remediation.
  • Limit access to ISIQ interfaces while remediation is pending.
  • Contact IBM support if operating an affected or unsupported version.

Validation and detection

  • Inventory all IBM Security Information Queue deployments and versions.
  • Confirm whether any instance runs versions 1.0.0 through 1.0.5.
  • Review HTTP response cookies for missing HTTPOnly attributes.
  • Check change records for IBM advisory remediation or upgrade completion.
  • Document residual risk for any instance that cannot be remediated.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-4289 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/S:U/I:N/C:L/PR:N/AC:L/UI:N/AV:N/A:N/E:U/RC:C/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.0MediumCVSS:3.0/S:U/I:N/C:L/PR:N/AC:L/UI:N/AV:N/A:N/E:U/RC:C/RL:O3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

5.3Medium
CVSS 3.0 vector shape for CVE-2020-4289Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/S:U/I:N/C:L/PR:N/AC:L/UI:N/AV:N/A:N/E:U/RC:C/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSecurity Information Queue1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.