CVE-2025-33121

Published: Jun 19, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Exploitability: 2.8 / Impact: 4.2

Source: psirt@us.ibm.com (Secondary)

Description

IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected (13)

Products: Ibm: Qradar Security Information And Event Manager

Ibm

1 product

Qradar Security Information And Event Manager

Configuration A

13 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ibm Qradar Security Information And Event Manager	Version 7.5.0
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_10
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_11
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_12
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_1
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_2
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_3
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_4
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_5
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_6
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_7
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_8
Ibm Qradar Security Information And Event Manager	Version 7.5.0 update_pack_9

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

https://www.ibm.com/support/pages/node/7237317

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.