CVE-2021-20429 — Incorrect Authorization in IBM Qradar User Behavior Analytics

CWE-863 — Incorrect AuthorizationCWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 65.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Qradar User Behavior AnalyticsIBM Qradar Siem
Timeline
PublishedMay 14
Latest updateMay 24

Description

IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 196334.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5ibm/qradar_siem1.0.0, 4.1.1+1

🔴Vulnerability Details

2
GHSA
GHSA-86rf-x36x-668f: IBM QRadar User Behavior Analytics 1↗2022-05-24
▶
CVEList
CVE-2021-20429: IBM QRadar User Behavior Analytics 1↗2021-05-14
▶
CVE-2021-20429 — Incorrect Authorization in IBM | cvebase