CVE-2014-0835

Published: Jan 30, 2014Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings.

Affected (1)

Products: Ibm: Qradar Security Information And Event Manager

Ibm

1 product

Qradar Security Information And Event Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Qradar Security Information And Event Manager	Up to 7.2.0

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (14)

http://osvdb.org/102554

Source: psirt@us.ibm.com

http://seclists.org/fulldisclosure/2014/Jan/166

Source: psirt@us.ibm.com

http://secunia.com/advisories/56653

Source: psirt@us.ibm.com

http://thomaspollet.blogspot.be/2014/01/ibm-qradar-siem-csrf-xss-mitm-rce.html

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21663066

Source: psirt@us.ibm.com

Vendor Advisory

http://www.securityfocus.com/bid/65127

Source: psirt@us.ibm.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/90678

Source: psirt@us.ibm.com

http://osvdb.org/102554