CVE-2014-4829 — Cross-Site Request Forgery in IBM Qradar Risk Manager

CWE-352 — Cross-Site Request Forgery3 documents3 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 71.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Qradar Risk ManagerIBM Qradar Security Information AND Event ManagerIBM Qradar Vulnerability Manager
Timeline
PublishedNov 28
Latest updateMay 17

Description

Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDibm/qradar_risk_manager6 versions+5

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7v2h-rwvq-x3jf: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7↗2022-05-17
▶
CVEList
CVE-2014-4829: Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7↗2014-11-28
▶
CVE-2014-4829 — Cross-Site Request Forgery in IBM | cvebase