IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 contain an XML External Entity (XXE) injection vulnerability (CWE-611). This vulnerability arises from improper restriction of XML external entity references during XML data processing. A remote attacker with low privileges can exploit this flaw to disclose sensitive information or cause memory exhaustion on the affected system. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to disclosure of sensitive information and partial denial of service through memory resource consumption. The attacker requires low privileges and no user interaction, making the vulnerability relatively accessible. Integrity is not impacted. Availability impact is low but present due to potential memory exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor IBM's official advisories for updates and apply patches once available. Until then, consider restricting XML input sources or disabling external entity processing if feasible.