CVE-2024-54173

Ibm Mq Appliance ≤ 9.4.2

Published

28 February 2025

Modified

03 July 2025

Patch / advisory

View advisory

CVSS Score v3.1 4.7

Click a component to see what it means

Raw vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0013 3th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-54173 is a medium-severity Improper Management of Sensitive Trace Data (CWE-1323) vulnerability in Ibm Mq Appliance. Its CVSS base score is 4.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-53952

Vulnerability Data

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD reveals potentially sensitive information in trace files that could be read by a local user when webconsole trace is enabled.

CWE(s): CWE-1323

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1119 Automated Collection Collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

attack.mitre.org →

T1552 Unsecured Credentials Credential Access

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-14456Same product: Ibm Mq Appliance

CVE-2024-25048Same product: Ibm Mq Appliance

CVE-2024-51471Same product: Ibm Mq Appliance

CVE-2023-46177Same product: Ibm Mq Appliance

CVE-2023-26285Same product: Ibm Mq Appliance

CVE-2023-22874Same product: Ibm Mq Appliance

CVE-2025-0975Same product: Ibm Mq Appliance

CVE-2023-46176Same product: Ibm Mq Appliance

CVE-2025-3631Same product: Ibm Mq Appliance

CVE-2025-23225Same product: Ibm Mq Appliance

Affected Assets

ibm

mq appliance

≤ 9.4.2 · 9.3.0.0 — 9.3.0.27 · 9.4.0.0 — 9.4.0.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces access authorizations so sensitive trace data cannot be stored or accessed in unprotected locations.

AC-4 Information Flow Enforcement good match

Enforces information flow policies that block trace data from reaching untrusted agents or destinations.

SC-28 Protection of Information at Rest good match

Requires protection of information at rest, directly stopping storage of trace data in unprotected locations.

SC-8 Transmission Confidentiality and Integrity good match

Requires confidentiality and integrity protection for all transmitted trace data, directly stopping exposure in transit.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match

prevents

Protecting data-at-rest directly prevents storage of trace data in unprotected locations.

PR.DS-02 mostly match

prevents

Protecting data-in-transit directly prevents transport of trace data to untrusted agents.

PR.DS-10 partial match

prevents

Protecting data-in-use can limit exposure during trace collection or processing.

PR.PS-04 partial match

prevents

Requiring protected log generation and handling indirectly covers sensitive trace data as a form of logging.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.12 Data leakage prevention mostly match

prevents

DLP mechanisms can detect and block exfiltration of trace data.

A.8.3 Information access restriction mostly match

prevents

Technical access restrictions directly prevent unauthorized access to trace storage.

A.5.12 Classification of information partial match

prevents

Classification identifies trace data as sensitive, guiding its protection.

A.5.14 Information transfer partial match

prevents

Rules for secure transfer reduce exposure when trace data leaves the SoC.