Lucene search

IBMFD56B10765CFF5A27A951FACFDB2324A2A1CA59C8D86304EE298209B8838B0D6

HistoryApr 30, 2024 - 8:34 a.m.

Security Bulletin: IBM QRadar Suite software is vulnerable to information exposure (CVE-2022-38386)

2024-04-3008:34:03

www.ibm.com

ibm qradar suite

information exposure

sensitive cookies

vulnerability

update

version 1.10.20.0

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Summary

IBM QRadar Suite software is vulnerable to information exposure through cookie settings. This has been addressed in the latest update. Please follow the instructions in the Remediation/Fixes section below to update to the latest version.

Vulnerability Details

CVEID:CVE-2022-38386
**DESCRIPTION:**IBM Cloud Pak for Security (CP4S) does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/233778 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Cloud Pak for Security	1.10.0.0 - 1.10.11.0
QRadar Suite Software

1.10.12.0 - 1.10.19.0

Remediation/Fixes

IBM strongly encourages customers to update their systems promptly.

Please upgrade to at least version 1.10.20.0 following these instructions: <https://www.ibm.com/docs/en/cloud-paks/cp-security/1.10?topic=installing-upgrading-cloud-pak-security>.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmcloud_pak_for_securityMatch1.10

VendorProductVersionCPE
ibmcloud_pak_for_security1.10cpe:2.3:a:ibm:cloud_pak_for_security:1.10:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	cloud_pak_for_security	1.10	cpe:2.3:a:ibm:cloud_pak_for_security:1.10:::::::*

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for FD56B10765CFF5A27A951FACFDB2324A2A1CA59C8D86304EE298209B8838B0D6