Vulnerability Description
IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Mq Operator | >= 2.0.0, <= 2.0.29 |
| Ibm | Supplied Mq Advanced Container Images | 9.3.0.0 |
Related Weaknesses (CWE)
References
- https://www.ibm.com/support/pages/node/7240431Vendor Advisory
FAQ
What is CVE-2025-36005?
CVE-2025-36005 is a vulnerability with a CVSS score of 5.9 (MEDIUM). IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could ...
How severe is CVE-2025-36005?
CVE-2025-36005 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-36005?
Check the references section above for vendor advisories and patch information. Affected products include: Ibm Mq Operator, Ibm Supplied Mq Advanced Container Images.