CVE-2019-4264 — Improper Certificate Validation in IBM Qradar Security Information AND Event Manager

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
5.9MEDIUMNVD
EPSS
0.1%
top 69.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Qradar Security Information AND Event ManagerIBM Qradar Siem
Timeline
PublishedMay 29
Latest updateMay 24

Description

IBM QRadar SIEM 7.2.8 WinCollect could allow an attacker to obtain sensitive information by spoofing a trusted entity using man in the middle techniques due to not validating or incorrectly validating a certificate. IBM X-Force ID: 160072.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/qradar_siem7.2.8

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4gf7-m762-7xq9: IBM QRadar SIEM 7↗2022-05-24
▶
CVEList
CVE-2019-4264: IBM QRadar SIEM 7↗2019-05-29
▶
CVE-2019-4264 — Improper Certificate Validation in IBM | cvebase