CVE-2015-1999
IBM Security QRadar Incident Forensics 7.2.x - Exposure of Sensitive Information via Session ID in URL
Title source: llmDescription
IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21968269
Scores
EPSS
0.0121
EPSS Percentile
64.7%
Details
CWE
CWE-200
Status
published
Products (6)
ibm/security_qradar_incident_forensics
7.2.0
ibm/security_qradar_incident_forensics
7.2.1
ibm/security_qradar_incident_forensics
7.2.2
ibm/security_qradar_incident_forensics
7.2.3
ibm/security_qradar_incident_forensics
7.2.4
ibm/security_qradar_incident_forensics
7.2.5
Published
Nov 08, 2015
Tracked Since
Feb 18, 2026