CVE-2021-38939: IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains

Medium severity · published Apr 27, 2022

CVE-2021-38939

IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains

5.3

CVSS

0.8%

EPSS

On KEV

Description

IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 58% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

QRadar SIEM · IBM

7.3.3; 7.4.3; 7.5.0 · source: vendor

Qradar Security Information And Event Manager · Ibm

7.3.0 before 7.3.3; 7.4.0 before 7.4.3; 7.3.3; 7.3.3; 7.3.3; 7.3.3; +11 more · source: NVD

Affected product

QRadar SIEM

IBM

All QRadar SIEM CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-38939

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-38939

VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/211037

Patch

https://www.ibm.com/support/pages/node/6574787