User Credential Exposure in IBM Db2 for Linux, UNIX, and Windows
CVE-2025-36131
4.6MEDIUM
What is CVE-2025-36131?
A vulnerability in IBM Db2 allows the clpplus command to expose user credentials in plaintext to the terminal. This issue affects versions 11.1.0 to 11.1.4.7, 11.5.0 to 11.5.9, and 12.1.0 to 12.1.3 across Linux, UNIX, and Windows platforms, including the Db2 Connect Server. An attacker with physical access to the system can potentially capture these credentials, posing significant security risks for organizations using affected Db2 versions.
Affected Version(s)
Db2 11.1.0 <= 11.1.4.7
Db2 11.5.0 <= 11.5.9
Db2 12.1.0 <= 12.1.3