CVE-2010-2637

CVE-2010-2637 describes a vulnerability in IBM WebSphere MQ versions 6.0 prior to 6.0.2.9 and 7.0 prior to 7.0.1.1. The flaw lies in the product's failure to encrypt usernames and passwords within the security parameters field when communicating with .NET client applications. This allows remote attackers to intercept sensitive authentication credentials by sniffing network traffic. The vulnerability has a CVSS v2 base score of 4.3, indicating a medium severity. It can be exploited remotely with medium attack complexity, leading to a partial compromise of confidentiality (C:P) as attackers can obtain sensitive information. There is no impact on integrity or availability. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community attention, with no social media discussion or media coverage reported.