CVE-2021-38949

CWE-312 — Cleartext Storage of Sensitive Info3 documents3 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 83.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM MQIBM Websphere MQ
Timeline
PublishedNov 16
Latest updateMay 24

Description

IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDibm/mq8.0.0.0 — 8.0.0.14+3
▶CVEListV5ibm/mq4 versions+3

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-544j-92pr-w749: IBM MQ 7↗2022-05-24
▶
CVEList
CVE-2021-38949: IBM MQ 7↗2021-11-16
▶
CVE-2021-38949 (MEDIUM CVSS 5.5) | IBM MQ 7.5 | cvebase.io