CVE-2020-4272

🗓️ 15 Apr 2020 15:13:56Reported by ibmType

cve🔗 web.nvd.nist.gov👁 99 Views🌐 WEB

IBM QRadar 7.3.0-7.3.3 Patch 2 allows remote code executio

Reporter	Title	Published	Views	Family All 9
zdt	QRadar Community Edition 7.3.1.6 Arbitrary Object Instantiation Vulnerability	24 Apr 202000:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to instantiation of arbitrary objects (CVE-2020-4272)	14 Apr 202014:28	–	ibm
CNVD	IBM QRadar SIEM File Upload Vulnerability	16 Apr 202000:00	–	cnvd
Cvelist	CVE-2020-4272	15 Apr 202015:13	–	cvelist
EUVD	EUVD-2020-25519	7 Oct 202500:30	–	euvd
NVD	CVE-2020-4272	15 Apr 202016:15	–	nvd
OSV	CVE-2020-4272	15 Apr 202016:15	–	osv
Packet Storm	QRadar Community Edition 7.3.1.6 Arbitrary Object Instantiation	21 Apr 202000:00	–	packetstorm
Prion	Code injection	15 Apr 202016:15	–	prion

NVD

Vulners

Node

AND

ibm qradar_security_information_and_event_managerRange7.3.0–7.3.3

ibm qradar_security_information_and_event_managerMatch7.3.3-

ibm qradar_security_information_and_event_managerMatch7.3.3p1

ibm qradar_security_information_and_event_managerMatch7.3.3p2

linux linux_kernelMatch-

[
  {
    "product": "QRadar",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.3.0"
      }
    ]
  },
  {
    "product": "Qradar",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.3.3.Patch2"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/6189645
packetstormsecurity	www.packetstormsecurity.com/files/157337/QRadar-Community-Edition-7.3.1.6-Arbitrary-Object-Instantiation.html
seclists	www.seclists.org/fulldisclosure/2020/Apr/40
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/175898

Parameter	Position	Path	Description	CWE
chart	query param	forensics/graphs.php	Vulnerable graphs.php parameter handling allows object instantiation and local file inclusion via unsanitized input, enabling arbitrary code execution or file inclusion when output_image triggers class loading.	CWE-502, CWE-22
dataset	query param	forensics/graphs.php	Vulnerable graphs.php parameter handling allows object instantiation and local file inclusion via unsanitized input, enabling arbitrary code execution or file inclusion when output_image triggers class loading.	CWE-502, CWE-22
output_image	query param	forensics/graphs.php	Vulnerable graphs.php parameter handling allows object instantiation and local file inclusion via unsanitized input, enabling arbitrary code execution or file inclusion when output_image triggers class loading.	CWE-502, CWE-22

17 Jun 2026 03:19Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.18.8

CVSS 35.5

EPSS0.02978