CVE-2025-36041

Katalog CVE

CVSS 9.8 · Critical EPSS 0,36%

Kerentanan Improper Certificate Validation pada ibm mq operator, ibm supplied mq advanced container images. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through 3.2.12 Native HA CRR could be configured with a private key and chain other than the intended key which could disclose sensitive information or allow the attacker to perform unauthorized actions.

Rincian

Terbit di NVD

15 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 100 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.ibm.com/support/pages/node/7236608 advisory vendor