CVE-2021-20337
published 2021-07-26CVE-2021-20337: IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.71%
49.2th percentile
IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 194448.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | qradar_security_information_and_event_manager | — | — |
| ibm | qradar_security_information_and_event_manager | — | — |
| ibm | qradar_security_information_and_event_manager | >= 7.3.0 < 7.3.3 | 7.3.3 |
| ibm | qradar_security_information_and_event_manager | >= 7.4.0 < 7.4.3 | 7.4.3 |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)
suricata·2021-08-20·CVSS 7.8
CVE-2021-27065 [HIGH] ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)
ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange ProxyLogon Activity - OABVirtualDirectory SetObject (CVE-2021-27065)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ecp/"; content:"/SetObject?"; content:"schema=OABVirtualDirectory"; fast_pattern; http.header_names; to_lowercase; content:"|0d 0a|msexchlogonmailbox|0d 0a|"; http.request_body; content:"__type"; content:"Microsoft.Exchange.Management.ControlPanel"; distance:0; content:"ExternalUrl"; distance:0; reference:url,github.com/praetorian-inc/proxylogon-exploit/blob/main/exploit.py; reference:cve,2021-27065; classtype:attempted-admin; sid:20337
No public exploits indexed.
No writeups or analysis indexed.
2021-07-26
Published