CVE-2025-12755mediumCWE-117

CVE-2025-12755: fallo de gravedad media en IBM MQ Operator

Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Publicada el

Seguir esta CVE+ Monitorear MQ Operator+ Monitorear supplied MQ Advanced container images

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4epss 0.1%
IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) contain a vulnerability where log messages are not properly neutralized before being written to log files. This flaw could allow an unauthorized user to inject malicious data into MQ log entries, potentially leading to misleading logs, log manipulation, or downstream log‑processing issues.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
IBM · MQ OperatorIBM · supplied MQ Advanced container images
CVEs relacionadas — IBM MQ Operator

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-39742HIGHIBM MQ Container authentication bypassEPSS 0.8%CVE-2024-39743MEDIUMIBM MQ Container denial of serviceEPSS 0.6%CVE-2026-10572HIGHIBM MQ Buffer OverflowEPSS 0.4%CVE-2026-10574HIGHIBM MQ Buffer OverflowEPSS 0.4%CVE-2025-27365MEDIUMIBM MQ Operator denial of serviceEPSS 0.4%CVE-2026-12148HIGHIBM MQ Deserialization of Untrusted DataEPSS 0.4%