Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-9738: IBM QRadar allows weak passwords, enabling account compromise
CVE-2016-9738 · published 9 years ago
Summary
IBM QRadar versions 7.2 and 7.3 do not force users to choose strong passwords by default. This makes it easier for an attacker to guess or crack a login and gain access to the system. Enable a stricter password policy or require complex passwords in the configuration settings.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ibm | qradar_security_information_and_event_manager |
7.2.0 7.2.1 7.2.2 7.2.3 7.2.4 7.2.5 7.2.6 7.2.7 7.2.8 7.3.0 cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.0:*:*:*:*:*:*:* |
Original advisory text
IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783.
IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 119783.
References
- http://www.ibm.com/support/docview.wss?uid=swg22004926 Patch Vendor Advisory
- http://www.securityfocus.com/bid/99266 Third Party Advisory VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/119783 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-2547PK - Security Features
Timeline
Published27 Jun 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-9738 · NVD
Track software like this
Free during beta