CVE-2014-6075

IBM QRadar SIEM, QRadar Risk Manager, and QRadar Vulnerability Manager - Credentials Exposure in URLs

Title source: llm
STIX 2.1

Description

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

References (2)

Core 2
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21691211
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/95727

Scores

EPSS 0.0117
EPSS Percentile 63.7%

Details

CWE
CWE-200
Status published
Products (17)
ibm/qradar_risk_manager 7.1.0
ibm/qradar_risk_manager 7.2.0
ibm/qradar_risk_manager 7.2.1
ibm/qradar_risk_manager 7.2.2
ibm/qradar_risk_manager 7.2.3
ibm/qradar_risk_manager 7.2.4
ibm/qradar_security_information_and_event_manager 7.1.0
ibm/qradar_security_information_and_event_manager 7.2.0
ibm/qradar_security_information_and_event_manager 7.2.1
ibm/qradar_security_information_and_event_manager 7.2.2
... and 7 more
Published Nov 28, 2014
Tracked Since Feb 18, 2026