Monday, November 4, 2024
HomeCyber Security NewsIBM QRadar SIEM Vulnerability Enables XSS Attack and Information Disclosure

IBM QRadar SIEM Vulnerability Enables XSS Attack and Information Disclosure

Published on

Malware protection

IBM QRadar is a popular SIEM (Security Incident and Event Management) tool organizations use to detect and monitor threats.

The IBM QRadar SIEM can be used in the form of a physical appliance, a software-only solution, or a virtual appliance.

As of 2023, It is being used by over 1130 companies worldwide as part of their SIEM.

- Advertisement - SIEM as a Service

IBM discovered three new vulnerabilities in the IBM SIEM and CVEs, and necessary fixes were also released.

These vulnerabilities were related to Cryptography, XSS, and information disclosure which was discovered by IBM’s Security Ethical Hacking team.

IBM QRadar SIEM Flaw

CVE-2023-26276: Weak Cryptographic Algorithm

This vulnerability exists due to the use of a weaker or expected cryptographic algorithm in the QRadar tool, which could allow a threat actor to decrypt highly sensitive information.

This vulnerability was given a CVSS Score of 5.9 (medium)

CVE-2023-26274: Cross-Site Scripting (XSS)

An attacker can exploit this vulnerability to embed arbitrary JS code in the Web UI that can alter the functionality that can lead to credentials disclosure through XSS on a trusted session.

This vulnerability was given a CVSS Score of 4.6 (medium).

CVE-2022-34352: Information Disclosure

This vulnerability allows a delegated Admin tenant with a specific domain security profile to see other domain data.

This vulnerability was given a CVSS Score of 6.5 (medium).

Affected Products

Affected Product(s)Version(s)
IBM QRadar SIEM7.5.0 – 7.5.0 UP5

Remediation and Fix

ProductVersionRemediation/First Fix
IBM QRadar SIEM7.5.0 7.5.0 UP6

There are no workarounds or mitigations available. IBM recommended all its users patch their IBM QRadar SIEM by upgrading it to the latest version.

“AI-based email security measures Protect your business From Email Threats!” – .

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...