Local User Password Exposure in IBM MQ Client Configuration
CVE-2025-36100

5.1MEDIUM

Key Information:

Vendor

IBM
Status
MQ
Vendor
CVE Published:
7 September 2025

What is CVE-2025-36100?

IBM MQ versions have a vulnerability where the application, when tracing is enabled, stores sensitive passwords in client configuration files. This information can be accessed by local users, potentially leading to unauthorized access to systems utilizing IBM MQ. Administrators are advised to disable trace functionality or implement robust access controls to mitigate exposure risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MQ 9.1.0.0 <= 9.1.0.29

MQ 9.2.0.0 <= 9.2.0.36

MQ 9.3.0.0 <= 9.3.0.30

References

https://www.ibm.com/support/pages/node/7243544
vendor-advisorypatch

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.