IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an improper restriction of XML External Entity references (CWE-611) in the mqweb MFT REST API. This flaw allows an authenticated attacker with MFT publish authority to perform XML external entity injection, potentially leading to disclosure of sensitive information or denial of service conditions.

Exploitation requires authentication with MFT publish authority. Successful exploitation can lead to disclosure of sensitive information or denial of service. The CVSS 3.1 base score is 6.8 (medium), reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict MFT publish authority to trusted users only and monitor for suspicious activity involving the mqweb MFT REST API.