SB2024060410 - Multiple vulnerabilities in IBM QRadar User Behavior Analytics
Published: June 4, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Code Injection (CVE-ID: CVE-2020-13936)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote attacker with ability to modify Velocity templates can inject and execute arbitrary Java code on the system with the same privileges as the account running the Servlet container.
2) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2023-3635)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Security restrictions bypass (CVE-ID: CVE-2018-11770)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists in Apache Spark running standalone master with the REST API enabled, or running Mesos master with cluster mode enabled due to improper security restrictions. A remote unauthenticated attacker can use the REST API, execute a driver program without authentication and perform unauthorized actions.
4) Information disclosure (CVE-ID: CVE-2018-11804)
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.
The vulnerability exists due to improper security restrictions set on the build/mvn script. A remote attacker can send a specially crafted request that submits malicious input, download and run a zinc server to speed up compilation and access sensitive information in files readable to the developer account running the build.
5) Improper input validation (CVE-ID: CVE-2018-17190)
The vulnerability allows an adjacent attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper security restrictions and insufficient validation of user-supplied input. An adjacent attacker with access to a Spark standalone cluster can send a specially crafted request that submits malicious input and execute arbitrary code on the master host, which could be used to conduct further attacks.
6) Improper Privilege Management (CVE-ID: CVE-2023-22946)
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper privilege management. A local user can send specially crafted configuration-related classes on the classpath and exploit this vulnerability to execute arbitrary code with the privileges of the submitting user.
7) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2023-46234)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to an error in the dsaVerify() function when validating public keys. A remote attacker can construct a public key in a way that it will be accepted as valid by the affected application and perform spoofing attack.
8) Incorrect Regular Expression (CVE-ID: CVE-2017-16137)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
9) Information disclosure (CVE-ID: CVE-2024-28849)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to credentials are shared via headers when following cross-domain redirects. A remote attacker can gain access to sensitive information.
10) Resource exhaustion (CVE-ID: CVE-2023-6481)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources in logback receiver component. A remote attacker can send send poisoned data, trigger resource exhaustion and perform a denial of service (DoS) attack.
11) Resource exhaustion (CVE-ID: CVE-2023-34462)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources if no idle timeout handler was configured. A remote attacker can send a client hello packet, which leads the server to buffer up to 16MB of data per connection and results in a denial of service condition.
12) Deserialization of Untrusted Data (CVE-ID: CVE-2022-25647)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to insecure input validation when processing serialized data passed to writeReplace() method. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.
13) Deserialization of Untrusted Data (CVE-ID: CVE-2023-6378)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insecure input validation when processing serialized data in logback receiver component. A remote attacker can pass specially crafted data to the application and cause a denial of service condition on the target system.
14) Resource exhaustion (CVE-ID: CVE-2023-34455)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
15) Integer overflow (CVE-ID: CVE-2023-34454)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in compress. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
16) Integer overflow (CVE-ID: CVE-2023-34453)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow in shuffle. A remote attacker can pass specially crafted data to the application, trigger integer overflow and cause a denial of service condition on the target system.
17) Cross-site scripting (CVE-ID: CVE-2024-22195)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the xmlattr filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
18) LDAP injection (CVE-ID: CVE-2023-25613)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper input validation when processing DLAP queries in LdapIdentityBackend. A remote non-authenticated attacker can send a specially crafted LDAP query to the application, bypass authentication process and gain unauthorized access to the application.
19) XML External Entity injection (CVE-ID: CVE-2022-46751)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
20) Code Injection (CVE-ID: CVE-2023-26145)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. A remote attacker can use these paths to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.
21) Authorization bypass through user-controlled key (CVE-ID: CVE-2023-44981)
The vulnerability allows a remote attacker to bypass authorization process.
The vulnerability exists due to improper implementation of SASL Quorum Peer authentication. The instance part in SASL authentication ID, which is listed in zoo.cfg server
list, is optional and if it's missing,
the authorization check will be skipped. As a
result an arbitrary endpoint could join the cluster and begin
propagating counterfeit changes to the leader, essentially giving it
complete read-write access to the data tree.
22) Improper Certificate Validation (CVE-ID: CVE-2023-31486)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to missing verification of the TLS certificate. A remote attacker can perform MitM attack and trick the application into downloading a malicious file.23) Path traversal (CVE-ID: CVE-2024-29180)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
24) Open redirect (CVE-ID: CVE-2023-26159)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data within the url.parse() function. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
25) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-41419)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests within keep-alive connection. A remote attacker can send several HTTP request to the server, bypass implemented filtration and smuggle arbitrary HTTP requests to the library.
Remediation
Install update from vendor's website.