CVE-2018-1648 : IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h

IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144653.

Published 2018-12-05 17:29:00

Updated 2018-12-26 16:39:32

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-1648

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1648

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-1648

CWE-326 Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1648

Products affected by CVE-2018-1648

IBM » Qradar Incident Forensics
Versions from including (>=) 7.2.0 and before (<) 7.2.8
cpe:2.3:a:ibm:qradar_incident_forensics:*:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics
Versions from including (>=) 7.3.0 and before (<) 7.3.1
cpe:2.3:a:ibm:qradar_incident_forensics:*:*:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1 Update P1
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p1:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1 Update P2
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p2:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P1
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p1:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P8
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p8:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P10
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p10:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P3
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p3:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P4
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p4:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P5
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p5:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P6
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p6:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P7
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p7:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P9
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p9:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P11
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p11:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P13
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p13:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1 Update P5
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p5:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1 Update P3
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p3:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.3.1 Update P4
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p4:*:*:*:*:*:*
Matching versions
IBM » Qradar Incident Forensics » Version: 7.2.8 Update P12
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p12:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-1648

Exploit prediction scoring system (EPSS) score for CVE-2018-1648

CVSS scores for CVE-2018-1648

CWE ids for CVE-2018-1648

References for CVE-2018-1648

Products affected by CVE-2018-1648