← Back

CVE-2025-36100

nvd nist
Published: Sep 7, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0  Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

Affected (6)

Products: Ibm: Mq
Ibm
1 product
Mq
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Mq
From 9.3.0.0 to 9.3.5.1
Mq
From 9.4.0.0 to 9.4.3.1
Mq
From 9.1.0.0 to 9.1.0.31
Mq
From 9.2.0.0 to 9.2.0.37
Mq
From 9.3.0.0 to 9.3.0.31
Mq
From 9.4.0.0 to 9.4.0.15

Related CWEs

CWE-260
Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.

References (1)

Source: psirt@us.ibm.com
PatchVendor Advisory

Timeline

No history available yet.