Spoofing attack in IBM QRadar



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-1733
CWE-ID CWE-451
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		IBM Qradar SIEM
Client/Desktop applications / Other client software

Vendor IBM Corporation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Spoofing attack

EUVDB-ID: #VU17335

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1733

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to the application fails to adequately filter user-controlled input data for syntax that has control-plane implications. A remote attacker can conduct spoofing attack and modify displayed content.

Mitigation

The vulnerability has been fixed in the versions 7.2.8 Patch 14, 7.3.1 Patch 7.

Vulnerable software versions

IBM Qradar SIEM: 7.2.0 - 7.3.1 Patch 6

CPE2.3 External links

http://www-01.ibm.com/support/docview.wss?uid=ibm10794523


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###