CWE-260
Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
CVE-2025-36100 (GCVE-0-2025-36100)
Vulnerability from cvelistv5 – Published: 2025-09-07 00:37 – Updated: 2025-10-09 16:22
VLAI
Title
IBM MQ information disclosure
Summary
IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.
Severity
5.1 (Medium)
CWE
- CWE-260 - Password in Configuration File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7243544 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | MQ |
Affected:
9.1.0.0 , ≤ 9.1.0.29
(semver)
Affected: 9.2.0.0 , ≤ 9.2.0.36 (semver) Affected: 9.3.0.0 , ≤ 9.3.0.30 (semver) Affected: 9.4.0.0 , ≤ 9.4.0.12 (semver) cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.1.0.29:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.2.0.36:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.3.0.30:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:lts:*:*:* cpe:2.3:a:ibm:mq:9.4.0.12:*:*:*:lts:*:*:* |
|
| IBM | MQ |
Affected:
9.3.0.0 , ≤ 9.3.5.1
(semver)
Affected: 9.4.0.0 , ≤ 9.4.3.0 (semver) cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:continuous_delivery:*:*:* cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:continuous_delivery:*:*:* cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:continuous_delivery:*:*:* cpe:2.3:a:ibm:mq:9.4.3.0:*:*:*:continuous_delivery:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-36100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-08T17:50:17.330773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-08T17:50:31.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:mq:9.1.0.0:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.1.0.29:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.2.0.36:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.0.30:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:lts:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.0.12:*:*:*:lts:*:*:*"
],
"defaultStatus": "unaffected",
"product": "MQ",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "9.1.0.29",
"status": "affected",
"version": "9.1.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.2.0.36",
"status": "affected",
"version": "9.2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.3.0.30",
"status": "affected",
"version": "9.3.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.0.12",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
],
"x_edition": "LTS"
},
{
"cpes": [
"cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:continuous_delivery:*:*:*",
"cpe:2.3:a:ibm:mq:9.3.5.1:*:*:*:continuous_delivery:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:continuous_delivery:*:*:*",
"cpe:2.3:a:ibm:mq:9.4.3.0:*:*:*:continuous_delivery:*:*:*"
],
"defaultStatus": "unaffected",
"product": "MQ",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "9.3.5.1",
"status": "affected",
"version": "9.3.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.3.0",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
}
],
"x_edition": "CD"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0\u0026nbsp; Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user."
}
],
"value": "IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0\u00a0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-260",
"description": "CWE-260 Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-09T16:22:51.045Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7243544"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThis issue was addressed under known issue DT444585\u003c/div\u003e\u003cbr\u003e\u003cdiv\u003eIBM MQ version 9.1 LTS\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts\"\u003eApply cumulative security update 9.1.0.31\u003c/a\u003e\u003c/div\u003e\u003cbr\u003e\u003cp\u003eIBM MQ version 9.2 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts\"\u003eApply cumulative security update 9.2.0.37\u003c/a\u003e\u0026nbsp; \u003c/p\u003e\u003cp\u003eIBM MQ version 9.3 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts\"\u003eApply cumulative security update 9.3.0.31\u003c/a\u003e\u003c/p\u003e\u003cp\u003eIBM MQ version 9.4 LTS\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts\"\u003eApply fix pack 9.4.0.15\u003c/a\u003e\u003c/p\u003e\u003cp\u003eIBM MQ version 9.3 CD and 9.4 CD\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/downloading-ibm-mq-94-cd\"\u003eUpgrade to IBM MQ version 9.4.3.1\u003c/a\u003e\u003c/p\u003e\u003c/div\u003e\n\n\u003cbr\u003e"
}
],
"value": "This issue was addressed under known issue DT444585\n\n\nIBM MQ version 9.1 LTS\n\n Apply cumulative security update 9.1.0.31 https://www.ibm.com/support/pages/downloading-ibm-mq-91-lts \n\n\nIBM MQ version 9.2 LTS\n\n Apply cumulative security update 9.2.0.37 https://www.ibm.com/support/pages/downloading-ibm-mq-92-lts \u00a0 \n\nIBM MQ version 9.3 LTS\n\n Apply cumulative security update 9.3.0.31 https://www.ibm.com/support/pages/downloading-ibm-mq-93-lts \n\nIBM MQ version 9.4 LTS\n\n Apply fix pack 9.4.0.15 https://www.ibm.com/support/pages/downloading-ibm-mq-94-lts \n\nIBM MQ version 9.3 CD and 9.4 CD\n\n Upgrade to IBM MQ version 9.4.3.1 https://www.ibm.com/support/pages/downloading-ibm-mq-94-cd"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM MQ information disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2025-36100",
"datePublished": "2025-09-07T00:37:00.421Z",
"dateReserved": "2025-04-15T21:16:16.297Z",
"dateUpdated": "2025-10-09T16:22:51.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-57754 (GCVE-0-2025-57754)
Vulnerability from cvelistv5 – Published: 2025-08-21 16:14 – Updated: 2025-08-21 17:31
VLAI
Title
eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
Summary
eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion.
Severity
9.8 (Critical)
CWE
- CWE-260 - Password in Configuration File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kristoferfannar/eslint-ban-mom… | x_refsource_CONFIRM |
| https://github.com/kristoferfannar/eslint-ban-mom… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kristoferfannar | eslint-ban-moment |
Affected:
<= 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-57754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T17:23:51.959161Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T17:31:58.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "eslint-ban-moment",
"vendor": "kristoferfannar",
"versions": [
{
"status": "affected",
"version": "\u003c= 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "eslint-ban-moment is an Eslint plugin for final assignment in VIHU. In 3.0.0 and earlier, a sensitive Supabase URI is exposed in .env. A valid Supabase URI with embedded username and password will allow an attacker complete unauthorized access and control over database and user data. This could lead to data exfiltration, modification or deletion."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-260",
"description": "CWE-260: Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T16:14:29.391Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kristoferfannar/eslint-ban-moment/security/advisories/GHSA-2486-4cjg-pw98",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kristoferfannar/eslint-ban-moment/security/advisories/GHSA-2486-4cjg-pw98"
},
{
"name": "https://github.com/kristoferfannar/eslint-ban-moment/commit/bc2d2f9d23e6ae961a23e0d769e0722870b11108",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kristoferfannar/eslint-ban-moment/commit/bc2d2f9d23e6ae961a23e0d769e0722870b11108"
}
],
"source": {
"advisory": "GHSA-2486-4cjg-pw98",
"discovery": "UNKNOWN"
},
"title": "eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-57754",
"datePublished": "2025-08-21T16:14:29.391Z",
"dateReserved": "2025-08-19T15:16:22.916Z",
"dateUpdated": "2025-08-21T17:31:58.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6513 (GCVE-0-2025-6513)
Vulnerability from cvelistv5 – Published: 2025-06-23 12:37 – Updated: 2025-06-23 13:25
VLAI
Title
BRAIN2 Configuration file for database access not sufficiently secured
Summary
Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.
Severity
9.3 (Critical)
CWE
- CWE-260 - Password in Configuration File
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Bizerba SE & Co. KG | BRAIN2 |
Affected:
0.0 , < 3.06
(semver)
|
Date Public
2025-06-22 22:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6513",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T13:25:51.725596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T13:25:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"x86"
],
"product": "BRAIN2",
"vendor": "Bizerba SE \u0026 Co. KG",
"versions": [
{
"lessThan": "3.06",
"status": "affected",
"version": "0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2025-06-22T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it.\u003cbr\u003e"
}
],
"value": "Standard Windows users can access the configuration file for database access of the BRAIN2 application and decrypt it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-260",
"description": "CWE-260: Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T12:37:55.000Z",
"orgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"shortName": "bizerba"
},
"references": [
{
"url": "https://www.bizerba.com/downloads/global/information-security/2025/bizerba-sa-2025-0003.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to the newest Version 3.06\u003cbr\u003e"
}
],
"value": "Update to the newest Version 3.06"
}
],
"source": {
"advisory": "BIZERBA-SA-2025-0003",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2025-05-24T22:00:00.000Z",
"value": "Release new BRAIN2 Version 3.06"
}
],
"title": "BRAIN2 Configuration file for database access not sufficiently secured",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eDeactivate not needed users or delete them\u003c/li\u003e\u003cli\u003eEnsure that only authorized users have access to the device/software\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "* Deactivate not needed users or delete them\n * Ensure that only authorized users have access to the device/software"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0beee27a-7d8c-424f-8e46-ac453fa147e6",
"assignerShortName": "bizerba",
"cveId": "CVE-2025-6513",
"datePublished": "2025-06-23T12:37:55.000Z",
"dateReserved": "2025-06-23T09:36:49.537Z",
"dateUpdated": "2025-06-23T13:25:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Architecture and Design
Description:
- Avoid storing passwords in easily accessible locations.
Mitigation
Phase: Architecture and Design
Description:
- Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
No CAPEC attack patterns related to this CWE.