CVE-2020-4280: IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization functi...

Summary

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to exec...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	qradar_security_information_and_event_manager	>= 7.3.0, <= 7.3.3 >= 7.4.0, <= 7.4.1 7.3.3 `cpe:2.3:a:ibm:qradar_security_information_and_event_manager::::::::`

Original advisory text

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization functi...

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 176140.

References

http://packetstormsecurity.com/files/159589/QRadar-RemoteJavaScript-Deserializat... Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2020/Oct/18 Exploit Mailing List Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/176140 VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6344079 Patch Vendor Advisory