Local User Sensitive Info Leak in IBM MQ WebConsole Trace (v9.3/9.4)
CVE-2024-54173 Published on February 28, 2025
IBM MQ information disclosure
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
Vulnerability Analysis
CVE-2024-54173 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Improper Management of Sensitive Trace Data
Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.
Products Associated with CVE-2024-54173
stack.watch emails you whenever new vulnerabilities are published in IBM Mq Appliance or IBM Mq. Just hit a watch button to start following.
Affected Versions
IBM MQ Version 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD is affected by CVE-2024-54173Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.