PT-2024-3189 · Ibm · Ibm Qradar Suite+1

Vincent Dragnea

·

Published

2024-04-22

·

Updated

2025-08-13

·

CVE-2023-47731

CVSS v2.0

5.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions IBM QRadar Suite Software versions 1.10.12.0 through 1.10.19.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0
Description The issue is related to stored cross-site scripting, allowing users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. This can be achieved by exploiting the lack of protection measures for the web page structure, enabling remote attackers to conduct cross-site scripting attacks by injecting malicious JavaScript code.
Recommendations For IBM QRadar Suite Software versions 1.10.12.0 through 1.10.19.0, update to a version outside of this range to resolve the issue. For IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the Web UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-03409
CVE-2023-47731

Affected Products

Ibm Cloud Pak For Security
Ibm Qradar Suite