CVE-2020-4888 : IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary com

IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 190912.

Published 2021-01-28 13:15:12

Updated 2021-02-02 17:35:35

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-4888

EPSS FAQ

11.97%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-4888

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.8	3.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2020-4888

https://www.ibm.com/support/pages/node/6409306

Security Bulletin: IBM QRadar SIEM is vulnerable to deserialization of untrusted data (CVE-2020-4888)
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/190912

IBM QRadar SIEM code execution CVE-2020-4888 Vulnerability Report
VDB Entry;Vendor Advisory

Products affected by CVE-2020-4888

IBM » Qradar Security Information And Event Manager » Version: 7.3.1 Update P3
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p3:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.1 Update P4
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p4:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.1 Update P6
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p6:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3 Update P1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:p1:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3 Update P2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:p2:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3 Update P3
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:p3:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3 Update P4
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:p4:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.3 Update P5
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.3:p5:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.0
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.0:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.1:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.1 Update Patch1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.1:patch1:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update P1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p1:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update P2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p2:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update P3
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p3:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update P4
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:p4:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.0 Update P1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.0:p1:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.0 Update P2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.0:p2:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.0
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.0:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.1 Update P5
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p5:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update Interim Fix 01
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:interim_fix_01:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.3.2 Update Interim Fix 02
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.2:interim_fix_02:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.2
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.2:-:*:*:*:*:*:*
Matching versions
IBM » Qradar Security Information And Event Manager » Version: 7.4.2 Update P1
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.4.2:p1:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-4888

Exploit prediction scoring system (EPSS) score for CVE-2020-4888

CVSS scores for CVE-2020-4888

CWE ids for CVE-2020-4888

References for CVE-2020-4888

Products affected by CVE-2020-4888