CVE-2025-36100
IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.1
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 0.10%
- CWE
- CWE-260
- Published
- 2025-09-07
- Last modified
- 2026-03-13
Affected products
- IBM MQ
- IBM MQ
- IBM MQ
- IBM MQ
Weakness type
Related vulnerabilities
- CVE-2019-25465 — Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
- CVE-2025-15151 — TaleLin Lin-CMS Tests Folder config.py password in configuration file
- CVE-2023-53770 — MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
- CVE-2023-53739 — Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure
- CVE-2025-33119 — IBM QRadar SIEM Information Disclosure
- CVE-2025-36002 — IBM Sterling B2B Integrator information disclosure
- CVE-2025-57754 — eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
- CVE-2025-6513 — BRAIN2 Configuration file for database access not sufficiently secured