Security Bulletin: IBM QRadar SIEM is vulnerable to incorrect permission assignment. (CVE-2016-9722)

Summary

The software specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Vulnerability Details

CVE-ID: CVE-2016-9722 **
Description:IBM QRadar specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS Base Score:** 4.20**
CVSS Temporal Score:** See https://exchange.xforce.ibmcloud.com/vulnerabilities/119737 for the current score**
CVSS Environmental Score:** Undefined*
CVSS Vector:** CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Products and Versions

· IBM QRadar 7.3 to 7.3.0 Patch 6

· IBM QRadar 7.2 to 7.2.8 Patch 10

Remediation/Fixes

· IBM QRadar/QRM/QVM/QRIF/QNI 7.3.1 GA

· IBM QRadar/QRM/QVM/QRIF/QNI 7.3.0 Patch 7

· IBM QRadar SIEM 7.2.8 Patch 11

Workarounds and Mitigations

None