CVE-2016-2876 : IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecifie

IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it easier for remote authenticated users to obtain root access by leveraging a command-injection issue.

Published 2016-11-30 18:59:05

Updated 2016-12-23 02:59:03

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2016-2876

IBM » Qradar Security Information And Event Manager » Update MR1
Versions up to, including, (<=) 7.1.0
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:mr1:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.0
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.2:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.3
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.3:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.4
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.4:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.1:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.5
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.5:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.2.6
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.6:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-2876

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 65 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-2876

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.5	HIGH	AV:N/AC:M/Au:S/C:C/I:C/A:C	6.8	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.5	HIGH	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.6	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-2876

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)
CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-2876

http://www-01.ibm.com/support/docview.wss?uid=swg21987774

IBM Security Bulletin: IBM QRadar SIEM contains unnecessary privilege usage. (CVE-2016-2876)
Patch;Vendor Advisory
http://www.securityfocus.com/bid/95001

IBM QRadar SIEM CVE-2016-2876 Unspecified Command Injection Vulnerability

Jump to

Vulnerability Details : CVE-2016-2876

Products affected by CVE-2016-2876

Exploit prediction scoring system (EPSS) score for CVE-2016-2876

CVSS scores for CVE-2016-2876

CWE ids for CVE-2016-2876

References for CVE-2016-2876