CVE-2019-4212

Published Jul 25, 2019

Last updated 2 years ago

Overview

Description: IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 159132.
Source: psirt@us.ibm.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 3.0

Type: Secondary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-352

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C48729A8-0CF2-486B-99E4-623C9C65F994",
            "versionEndExcluding": "7.2.8",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1647C51C-71ED-491A-893F-D6998825F867",
            "versionEndExcluding": "7.3.2",
            "versionStartIncluding": "7.3.0"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EC724282-7431-465E-8E60-4037121B8838"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "73151221-C102-4425-9316-1EE4CAAB6531"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D1E9DDCD-6D22-4175-94EF-D8A5457E7355"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "35AB906F-43CD-4D54-8274-1FD551532E58"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p12:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1ADC75F0-B27E-4B15-B829-482FBA0063A5"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p13:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D015D670-8AEA-49A3-8D22-9E3009322EB0"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p14:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C18F3CC3-9BCF-4DE8-B7CA-59587D5E61F5"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p15:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E543BC0F-ADFB-4CF2-BC6C-90DC76BE3A95"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2356A4E6-561B-40CA-8348-B30D581B1E46"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "74509F3F-840E-48B8-88B1-EA4FFB90ACC3"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BE7BD528-628F-4CA9-9FE8-8A79BDC97680"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "26118C2B-78CC-4038-9DEA-7A9417029790"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "29EBC1DD-6949-4B12-8CA5-EE2BCDB8C4C3"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F445D93-D482-4A74-810D-66D78CBCAFED"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C9F200C-ECC9-4D51-AFE7-E99C16D09148"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56B87CB5-0F77-4040-BB58-9DBF5723A4FD"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FECD03EF-2984-44F7-8DAD-BD3A608C2631"
          },
          {
            "criteria": "cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "43BD0A0A-349D-4C40-A1BF-78853DE8C72A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References