CVE-2025-12755

MEDIUM

4.0

Description

IBM MQ Operator (SC2 v3.2.0–3.8.1, LTS v2.0.0–2.0.29) and IBM‑supplied MQ Advanced container images (across affected SC2, CD, and LTS 9.3.x–9.4.x releases) contain a vulnerability where log messages are not properly neutralized before being written to log files. This flaw could allow an unauthorized user to inject malicious data into MQ log entries, potentially leading to misleading logs, log manipulation, or downstream log‑processing issues.

Details CVE

Score CVSS v3.14.0

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Vecteur d'attaqueLOCAL

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/17/2026

Derniere modification2/18/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-117

References

https://www.ibm.com/support/pages/node/7260087(psirt@us.ibm.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.