CVE-2020-4888
HighIBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function.
Published Jan 28, 2021 · Updated Nov 21, 2024
Key Facts
Patch immediately- CVE-2020-4888 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Qradar Security Information And Event Manager (Ibm), QRadar SIEM.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 62% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
62%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-4888 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 190912.
Affected Products
27 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Qradar Security Information And Event ManagerIbm | 7.3.0, 7.3.1, 7.3.1-p3, 7.3.1-p4, 7.3.1-p5, 7.3.1-p6, 7.3.2, 7.3.2-interim_fix_01 | n/a |
| QRadar SIEM | >= 7.3 | n/a |
Timeline
Publicly disclosed
Jan 28, 2021
Last updated
Nov 21, 2024
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
FAQ
Common Questions.
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function.
Affected: Qradar Security Information And Event Manager (Ibm) versions 7.3.0, 7.3.1, 7.3.1-p3, 7.3.1-p4, 7.3.1-p5, 7.3.1-p6, 7.3.2, 7.3.2-interim_fix_01; QRadar SIEM versions >= 7.3. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-4888 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo