SB2018053010 - Multiple vulnerabilities in IBM Qradar SIEM
Published: May 30, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) SQL injection (CVE-ID: CVE-2017-1722)
The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.
Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.
2) Remote code execution (CVE-ID: CVE-2017-1721)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to IBM QRadar Incident Forensics uses insecure functions such as eval. A remote attacker can execute arbitrary code with elevated privileges.
3) Path traversal (CVE-ID: CVE-2017-1723)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to insufficient validation of user-supplied inout. A remote attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attack and view arbitrary files on the system.
Remediation
Install update from vendor's website.