CVE-2019-4262 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2019-4262

Analyzed

More Info Official Page

Source-psirt@us.ibm.com

Published At-26 Sep, 2019 | 15:15

Updated At-30 Oct, 2019 | 14:57

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the QRadar system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 160014.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Secondary	3.0	5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.0

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

IBM Corporation

>>qradar_security_information_and_event_manager>>Versions from 7.2.0(inclusive) to 7.2.8(exclusive)

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>Versions from 7.3.0(inclusive) to 7.3.2(exclusive)

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p12:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p13:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p14:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p15:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p16:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.2.8

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.3.2

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:-:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.3.2

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p1:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.3.2

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p2:*:*:*:*:*:*

IBM Corporation

>>qradar_security_information_and_event_manager>>7.3.2

cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p3:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Primary	nvd@nist.gov

CWE ID: CWE-918

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/160014	psirt@us.ibm.com	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/1074538	psirt@us.ibm.com	Patch Vendor Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/160014

Source: psirt@us.ibm.com

Resource:

VDB Entry

Vendor Advisory

Hyperlink: https://www.ibm.com/support/pages/node/1074538

Source: psirt@us.ibm.com

Resource:

Patch

Vendor Advisory