title: IBM MQ Container information disclosure
description: IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command.  IBM X-Force ID:  272638.
problem types: CWE-319 Cleartext Transmission of Sensitive Information
affected:
{
defaultStatus: unaffected
product: MQ Operator
vendor: IBM
versions:
lessThanOrEqual: 2.0.18 LTS, status: affected, version: 2.0.0 LTS, versionType: semver
lessThanOrEqual: 2.4.7, status: affected, version: 2.4.0, versionType: semver
lessThanOrEqual: 2.3.3, status: affected, version: 2.3.0, versionType: semver
lessThanOrEqual: 2.2.2, status: affected, version: 2.2.0, versionType: semver
lessThanOrEqual: 3.0.1 CD, status: affected, version: 3.0.0 CD, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL