Riskcovery

CVE-2025-36100

IBM MQ information disclosure

State
Published
Severity
5.1 Medium
Published
Sep 7, 2025
Updated
Oct 9, 2025
Reserved
Apr 15, 2025

Read the record on cve.org

Description

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0  Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

Scores

CVSSScoreVectorSource
3.15.1 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nibm

Weaknesses

  • CWE-260 Password in Configuration File

Affected Products

ProductVersions
MQIBM
  • 9.1.0.0 through 9.1.0.29Affected
  • 9.2.0.0 through 9.2.0.36Affected
  • 9.3.0.0 through 9.3.0.30Affected
  • 9.4.0.0 through 9.4.0.12Affected
MQIBM
  • 9.3.0.0 through 9.3.5.1Affected
  • 9.4.0.0 through 9.4.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.