CVE-2023-33859 : IBM Security QRadar EDR 3.12 could disclose sensitive information due to an obse

IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697.

Published 2024-07-10 16:15:03

Updated 2024-07-31 14:35:50

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2023-33859

IBM » Security Qradar Edr » Version: 3.12
cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
Matching versions
IBM » Security Qradar Edr » Version: 3.12
cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST	2024-07-31
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	IBM Corporation	2024-07-10
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE-204 Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Assigned by: psirt@us.ibm.com (Primary)

https://www.ibm.com/support/pages/node/7159770

Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities (CVE-2023-35006, CVE-2023-33859, CVE-2023-33860, CVE-2023-35008)
Vendor Advisory

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/257697

IBM Security ReaQta information disclosure CVE-2023-33859 Vulnerability Report
VDB Entry

Jump to