PT-2023-4945 · Ibm · Ibm Qradar Wincollect Agent

Alexander Staalgaard · Published 2023-07-25 · Updated 2023-09-13 · CVE-2023-38736

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM QRadar WinCollect Agent versions 10.0 through 10.1.6

Description The issue is related to insufficient access control in the IBM QRadar WinCollect Agent, which can be exploited by a remote attacker to elevate their privileges. A normal user could utilize this vulnerability to gain SYSTEM permissions when the agent is installed to run as ADMIN or SYSTEM.

Recommendations For IBM QRadar WinCollect Agent versions 10.0 through 10.1.6, consider restricting the agent's privileges to prevent a local escalation of privilege attack until a patch is available. As a temporary workaround, avoid running the agent as ADMIN or SYSTEM to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-275

CWE-264

Related Identifiers

BDU:2023-05458

CVE-2023-38736

Affected Products

Ibm Qradar Wincollect Agent

References · 10

• https://osv.dev/vulnerability/CVE-2023-38736 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/262542 · Vendor Advisory
• https://ibm.com/support/pages/node/7030703 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38736 · Security Note
• https://t.me/cibsecurity/70159 · Telegram Post
• https://vuldb.com/ru/?id.239265 · Note
• https://twitter.com/CVEnew/status/1700225732838895885 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1700249391192211854 · Twitter Post
• https://twitter.com/cracbot/status/1700388603069865985 · Twitter Post