CVE-2021-38949

MEDIUM

IBM MQ 8.0.0.0-8.0.0.13, 9.0.0.0-9.0.0.8, 9.1.0-9.1.4 - Cleartext Storage of Sensitive Information

Title source: llm

IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

Broken Link, VDB Entry vdb-entry x_refsource_xf

CVSS v3 5.5

EPSS 0.0005

EPSS Percentile 17.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-312

Status published

Products (4)

ibm/mq 8.0.0.0 - 8.0.0.14

ibm/mq 9.0.0.0 - 9.0.0.9

ibm/mq 9.1.0 - 9.1.5

ibm/websphere_mq 7.5

Published Nov 16, 2021

Tracked Since Feb 18, 2026