PT-2021-5241 · Ibm · Ibm Qradar Siem

Published 2021-11-26 · Updated 2021-12-02 · CVE-2021-29863

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.3 through 7.4

Description The issue is related to insufficient validation of incoming requests, which can be exploited by a remote attacker to perform a Server Side Request Forgery (SSRF) attack by sending specially crafted requests. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Recommendations For IBM QRadar SIEM versions 7.3 and 7.4, consider restricting access to the system to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the functionality that allows sending requests from the system to mitigate the risk of SSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2021-06045

BDU:2021-06279

CVE-2021-29863

Affected Products

Ibm Qradar Siem

References · 7

• https://ibm.com/support/pages/node/6520490 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06279 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/206087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29863 · Security Note
• https://bdu.fstec.ru/vul/2021-06045 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29863 · Vendor Advisory
• https://t.me/cibsecurity/33217 · Telegram Post