Medium severity · published Mar 3, 2024
CVE-2023-47745
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user…
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
IBM MQ Operator 2.0.0 LTS, 2.0.18 LTS, 3.0.0 CD, 3.0.1 CD, 2.4.0 through 2.4.7, 2.3.0 through 2.3.3, 2.2.0 through 2.2.2, and 2.3.0 through 2.3.3 stores or transmits user credentials in plain clear text which can be read by a local user using a trace command. IBM X-Force ID: 272638.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MQ Operator · Ibm
2.2.0 through 2.2.2; 2.3.0 through 2.3.3; 2.4.0 through 2.4.7; 2.0.0; 2.0.18; 3.0.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47745
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/272638
Vendor Advisory
https://www.ibm.com/support/pages/node/7126571
More from MQ Operator
9.8
CVE-2026-12665
IBM MQ Buffer Overflow
9.8
CVE-2025-36041
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1 through 3.5.3, and MQ Operator SC2 3.2.0 through…
9.8
CVE-2024-39742
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability
8.8
CVE-2026-10572
IBM MQ Buffer Overflow
8.8
CVE-2026-10574
IBM MQ Buffer Overflow