CVE-2020-4280medium

CVE-2020-4280: medium-severity vulnerability in IBM QRadar SIEM

Published · Updated

Follow this CVE+ Monitor QRadar SIEM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 69%
In short

IBM QRadar SIEM versions 7.3 and 7.4 have a flaw that allows attackers to run malicious commands on the server by sending specially crafted data. This happens because the software unsafely processes Java objects without proper validation.

Technical detail

The vulnerability exists in the Java deserialization function of QRadar SIEM 7.3/7.4, where user-supplied serialized objects are processed without adequate validation. An unauthenticated remote attacker can send a malicious serialized Java object to trigger arbitrary command execution on the affected system.

Summary generated and translated by AI from the official description.
IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 176140.
CVSS:3.0/AC:L/A:L/I:L/C:L/PR:L/UI:N/S:U/AV:N/E:U/RC:C/RL:O
Affected products
IBM · QRadar SIEM
Related CVEs — IBM QRadar SIEM

In the same product, most dangerous first.

CVE-2020-4888MEDIUMCVE-2020-4888EPSS 62.3%CVE-2018-1612MEDIUMCVE-2018-1612EPSS 55.7%CVE-2018-1571HIGHCVE-2018-1571EPSS 4.7%CVE-2020-4789MEDIUMCVE-2020-4789EPSS 2.6%CVE-2019-4210CRITICALCVE-2019-4210EPSS 2.2%CVE-2019-4545HIGHCVE-2019-4545EPSS 2.1%