CVEvulnerability

CVE-2025-36100

5.5 MEDIUM Published 2025-09-07 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-09-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.1 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-260

Description

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0  Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

Affected configurations

• ibm mq (>= 9.1.0.0 < 9.1.0.31) • ibm mq (>= 9.2.0.0 < 9.2.0.37) • ibm mq (>= 9.3.0.0 < 9.3.0.31) • ibm mq (>= 9.3.0.0 <= 9.3.5.1) • ibm mq (>= 9.4.0.0 < 9.4.0.15) • ibm mq (>= 9.4.0.0 < 9.4.3.1)

Related

Weakness · CWE (1)

  • CWE-260 Password in Configuration File weakness

References