Lucene search

IBM25A81B5D009531E324A5C1E8F352A292BD9F91043F1E66CDC3396265F916672C

HistoryJul 24, 2024 - 1:34 p.m.

Security Bulletin: IBM QRadar Suite software is vulnerable to information exposure

2024-07-2413:34:28

www.ibm.com

ibm qradar suite

information exposure

cve-2023-47728

remote attacker

sensitive information

cvss

ibm cloud pak for security

version 1.10.23.0

system update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

Summary

IBM QRadar Suite software is vulnerable to information exposure through a detailed technical error message. This has been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version.

Vulnerability Details

CVEID:CVE-2023-47728
**DESCRIPTION:**IBM QRadar Suite Software could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the request. This information could be used in further attacks against the system.
CVSS Base score: 4.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/272201 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Cloud Pak for Security	1.10.0.0 - 1.10.11.0
QRadar Suite Software

1.10.12.0 - 1.10.22.0

Remediation/Fixes

**IBM strongly encourages customers to update their systems promptly.

**Please upgrade to at least version 1.10.23.0 following these instructions: <https://www.ibm.com/docs/en/cloud-paks/cp-security/1.10?topic=installing-upgrading-cloud-pak-security>.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmcloud_pak_for_securityMatch1.10

VendorProductVersionCPE
ibmcloud_pak_for_security1.10cpe:2.3:a:ibm:cloud_pak_for_security:1.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	cloud_pak_for_security	1.10	cpe:2.3:a:ibm:cloud_pak_for_security:1.10:::::::*

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.001

Percentile

37.7%

JSON

Related for 25A81B5D009531E324A5C1E8F352A292BD9F91043F1E66CDC3396265F916672C