PT-2018-1998 · Ibm · Ibm Qradar Siem

Chris Shepherd + 7 · Published 2018-12-04 · Updated 2019-10-09 · CVE-2018-1730

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.2 through 7.3

Description The issue is related to incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to expose sensitive information or consume memory resources. This can be achieved through a XML External Entity Injection (XXE) attack when processing XML data.

Recommendations For IBM QRadar SIEM versions 7.2 and 7.3, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting XML data processing to minimize the risk of XXE attacks until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2018-01614

CVE-2018-1730

Affected Products

Ibm Qradar Siem

References · 6

• https://ibm.com/support/docview.wss?uid=ibm10742741&myns=swgother&mynp=OCSSBQAC&mync=E&cm_sp=swgother-_-OCSSBQAC-_-E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1730 · Security Note
• https://bdu.fstec.ru/vul/2018-01614 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/147709 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1730 · Vendor Advisory
• https://www-01.ibm.com/support/docview.wss?uid=ibm10742741 · Note