CVE-2025-36100

Summary

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0  Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

Affected Software

VendorProductVersion RangeStatus
IBMMQ9.1.0.0 <= 9.1.0.29affected
IBMMQ9.2.0.0 <= 9.2.0.36affected
IBMMQ9.3.0.0 <= 9.3.0.30affected
IBMMQ9.4.0.0 <= 9.4.0.12affected
IBMMQ9.3.0.0 <= 9.3.5.1affected
IBMMQ9.4.0.0 <= 9.4.3.0affected

Weaknesses

  • CWE-260: CWE-260 Password in Configuration File

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References