CVE-2014-6075 — Sensitive Information Exposure in IBM Qradar Risk Manager

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 56.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Qradar Risk ManagerIBM Qradar Security Information AND Event ManagerIBM Qradar Vulnerability Manager
Timeline
PublishedNov 28
Latest updateMay 17

Description

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDibm/qradar_risk_manager6 versions+5

Patches

Patch: www-01.ibm.com ↗Patch: www-01.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-62pp-mcmg-6p2q: IBM Security QRadar SIEM and QRadar Risk Manager 7↗2022-05-17
▶
CVEList
CVE-2014-6075: IBM Security QRadar SIEM and QRadar Risk Manager 7↗2014-11-28
▶
CVE-2014-6075 — Sensitive Information Exposure in IBM | cvebase