Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

IBM Security QRadar 3.12: Stored User Credentials Exposed

CVE-2024-45638 · published 1 year ago
Summary

IBM Security QRadar 3.12 stores user passwords in plain text, which means a local user with admin access can see them. This is a security risk because it allows unauthorized access to sensitive information. To fix this, IBM recommends updating to a newer version of QRadar that fixes this issue.

What to do
  • Update ibm security_qradar_edr to version 3.12.16 or later.
Affected software
VendorProductAffected versions
ibm security_qradar_edr >= 3.12, < 3.12.16
cpe:2.3:a:ibm:security_qradar_edr:*:*:*:*:*:*:*:*
Original advisory text
IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.
IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-256Plaintext Storage of a Password
Timeline
Published14 Mar 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-45638 · NVD
Track software like this
Free during beta