CVE-2020-4789 — Path Traversal in IBM Qradar Siem

CWE-22 — Path Traversal3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 41.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Qradar SiemIBM Qradar Security Information AND Event Manager
Timeline
PublishedJan 27
Latest updateMay 24

Description

IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 189302.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/qradar_siem6 versions+5

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-vf9c-cf8r-7f65: IBM QRadar SIEM 7↗2022-05-24
▶
CVEList
CVE-2020-4789: IBM QRadar SIEM 7↗2021-01-27
▶
CVE-2020-4789 — Path Traversal in IBM Qradar Siem | cvebase