CVE-2024-54173 - Vulnerability Details

Vendors	Products
Ibm	Mq

Link	Providers
https://www.ibm.com/support/pages/node/7183370

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.
Title		IBM MQ information disclosure
First Time appeared		Ibm Ibm mq
Weaknesses		CWE-1323
CPEs		cpe:2.3:a:ibm:mq:9.3.0::::continuous_delivery::: cpe:2.3:a:ibm:mq:9.3.0::::lts::: cpe:2.3:a:ibm:mq:9.4.0::::continuous_delivery::: cpe:2.3:a:ibm:mq:9.4.0::::lts:::
Vendors & Products		Ibm Ibm mq
References		https://www.ibm.com/support/pages/node/7183370
Metrics		cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-54173", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-11-30T14:47:41.352Z", "datePublished": "2025-02-28T02:22:14.364Z", "dateUpdated": "2025-02-28T16:37:38.519Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*"], "defaultStatus": "unaffected", "product": "MQ", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled."}], "value": "IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1323", "description": "CWE-1323 Improper Management of Sensitive Trace Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-02-28T02:22:14.364Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7183370"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM MQ information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T16:35:01.988933Z", "id": "CVE-2024-54173", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T16:37:38.519Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-54173 (string)

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

state : PUBLISHED (string)

assignerShortName : ibm (string)

dateReserved : 2024-11-30T14:47:41.352Z (string)

datePublished : 2025-02-28T02:22:14.364Z (string)

dateUpdated : 2025-02-28T16:37:38.519Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:* (string)

1 : cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:* (string)

2 : cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:* (string)

3 : cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:* (string)

]

defaultStatus : unaffected (string)

product : MQ (string)

vendor : IBM (string)

versions : [ »

0 : { »

status : affected (string)

version : 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. (string)

}

]

value : IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-1323 (string)

description : CWE-1323 Improper Management of Sensitive Trace Data (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

dateUpdated : 2025-02-28T02:22:14.364Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://www.ibm.com/support/pages/node/7183370 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : IBM MQ information disclosure (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-02-28T16:35:01.988933Z (string)

id : CVE-2024-54173 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-28T16:37:38.519Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-54173", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-11-30T14:47:41.352Z", "datePublished": "2025-02-28T02:22:14.364Z", "dateUpdated": "2025-02-28T16:37:38.519Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*", "cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*"], "defaultStatus": "unaffected", "product": "MQ", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled."}], "value": "IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1323", "description": "CWE-1323 Improper Management of Sensitive Trace Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-02-28T02:22:14.364Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7183370"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM MQ information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-54173", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T16:35:01.988933Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T16:37:34.220Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-54173 (string)

assignerOrgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

state : PUBLISHED (string)

assignerShortName : ibm (string)

dateReserved : 2024-11-30T14:47:41.352Z (string)

datePublished : 2025-02-28T02:22:14.364Z (string)

dateUpdated : 2025-02-28T16:37:38.519Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:* (string)

1 : cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:* (string)

2 : cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:* (string)

3 : cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:* (string)

]

defaultStatus : unaffected (string)

product : MQ (string)

vendor : IBM (string)

versions : [ »

0 : { »

status : affected (string)

version : 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. (string)

}

]

value : IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-1323 (string)

description : CWE-1323 Improper Management of Sensitive Trace Data (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9a959283-ebb5-44b6-b705-dcc2bbced522 (string)

shortName : ibm (string)

dateUpdated : 2025-02-28T02:22:14.364Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vendor-advisory (string)

]

url : https://www.ibm.com/support/pages/node/7183370 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : IBM MQ information disclosure (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-54173 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-02-28T16:35:01.988933Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-28T16:37:34.220Z (string)

}

]

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled."}], "id": "CVE-2024-54173", "lastModified": "2025-02-28T03:15:09.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2025-02-28T03:15:09.357", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7183370"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1323"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled. (string)

}

]

id : CVE-2024-54173 (string)

lastModified : 2025-02-28T03:15:09.357 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1 (number)

impactScore : 3.6 (number)

source : psirt@us.ibm.com (string)

type : Primary (string)

}

]

}

published : 2025-02-28T03:15:09.357 (string)

references : [ »

0 : { »

source : psirt@us.ibm.com (string)

url : https://www.ibm.com/support/pages/node/7183370 (string)

}

]

sourceIdentifier : psirt@us.ibm.com (string)

vulnStatus : Received (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-1323 (string)

}

]

source : psirt@us.ibm.com (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object