IBM MQ information disclosure (IBM MQ)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.10 % · percentile 1 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ibm
- NVD status
- Analyzed
Description
IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0Â Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.
Weaknesses (CWE)
- CWE-260 — Password in Configuration File
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | ibm |
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@us.ibm.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-27092
- GCVE · GCVE-0-2025-36100
Affected configurations (NVD CPE)
cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*≥ 9.1.0.0 < 9.1.0.31cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*≥ 9.2.0.0 < 9.2.0.37cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*≥ 9.3.0.0 < 9.3.0.31cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*≥ 9.3.0.0 ≤ 9.3.5.1cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*≥ 9.4.0.0 < 9.4.0.15cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*≥ 9.4.0.0 < 9.4.3.1
Affected products
| Product | Versions |
|---|---|
| IBM · MQ | affected 9.1.0.0 ≤ 9.1.0.29 ; affected 9.2.0.0 ≤ 9.2.0.36 ; affected 9.3.0.0 ≤ 9.3.0.30 ; affected 9.4.0.0 ≤ 9.4.0.12 |
| IBM · MQ | affected 9.3.0.0 ≤ 9.3.5.1 ; affected 9.4.0.0 ≤ 9.4.3.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |