CVE-2016-2874

LOW

IBM QRadar SIEM < 7.1.0 - Authenticated Sensitive Information Exposure via Improper Access Control

Title source: llm
STIX 2.1

Description

IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

References (2)

Core 2
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21987771
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95003

Scores

CVSS v3 3.1
EPSS 0.0062
EPSS Percentile 45.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-284
Status published
Products (8)
ibm/qradar_security_information_and_event_manager 7.2.0
ibm/qradar_security_information_and_event_manager 7.2.1
ibm/qradar_security_information_and_event_manager 7.2.2
ibm/qradar_security_information_and_event_manager 7.2.3
ibm/qradar_security_information_and_event_manager 7.2.4
ibm/qradar_security_information_and_event_manager 7.2.5
ibm/qradar_security_information_and_event_manager 7.2.6
ibm/qradar_security_information_and_event_manager < 7.1.0
Published Nov 30, 2016
Tracked Since Feb 18, 2026