HTTP: IBM QRadar SIEM Authentication Bypass
This signature detects an attempt to exploit an authentication bypass which has been reported in IBM QRadar SIEM. A remote, unauthenticated user can exploit this vulnerability by sending a crafted request to the target server. Successful exploitation results in the execution of arbitrary commands as the "nobody" user.
Extended Description
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. IBM X-Force ID: 138824.
Affected Products
Ibm qradar_security_information_and_event_manager
Short Name
HTTP:IBM-QRADAR-AUTH-BP
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
Authentication Bypass CVE-2018-1418 IBM QRadar SIEM
Release Date
06/11/2018
Supported Platforms
mx-19.3
vmx-19.3
vsrx-19.2
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-19.4
vsrx3bsd-19.4
srx-branch-19.4
vsrx-19.4
vmx-19.4
mx-19.4
srxevo-25.4
vsrx-26.2
srx-26.2
srx-branch-26.2
vsrx3bsd-26.2
mx-12.3
srx-12.3
srx-branch-12.3
vsrx-12.3
Sigpack Version
3462
False Positive
Unknown
Vendors
Ibm
CVSS Score
6.5