PT-2024-11613 · Ibm · Ibm Qradar Suite+1

Ben Goodspeed + 8 · Published 2024-08-13 · Updated 2024-09-21 · CVE-2022-38382

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.11.0 IBM QRadar Suite Software versions 1.10.12.0 through 1.10.23.0

Description The issue is related to the failure to invalidate a session after logout, which could allow another authenticated user to obtain sensitive information. This could lead to unauthorized access.

Recommendations For IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.11.0, upgrade to a version that contains the fix for this issue. For IBM QRadar Suite Software versions 1.10.12.0 through 1.10.23.0, upgrade to a version that contains the fix for this issue. As a temporary workaround, consider implementing additional access controls to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-38382

Affected Products

Ibm Cloud Pak For Security

Ibm Qradar Suite

References · 9

• https://osv.dev/vulnerability/CVE-2022-38382 · Vendor Advisory
• https://ibm.com/support/pages/node/7165286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38382 · Security Note
• https://t.me/cvenotify/95568 · Telegram Post
• https://twitter.com/oktsec/status/1824827064823721995 · Twitter Post
• https://t.me/cvenotify/90208 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/233672 · Note
• https://t.me/cvenotify/94354 · Telegram Post
• https://t.me/cvedetector/2943 · Telegram Post