Security Bulletin: IBM Security QRadar EDR Software has multiple vulnerabilities (CVE-2023-35006, CVE-2023-33859, CVE-2023-33860, CVE-2023-35008)

Summary

IBM Security QRadar EDR Software is vulnerable to link injection and could also allow an attacker to embed links (URLs) to an external site or to different pages. Sensitive information could also be disclosed due to an observable login response discrepancy and web pages could be stored locally which can be read by another user on the system. These vulnerabilities have been addressed in the update.

Vulnerability Details

CVEID:CVE-2023-35006
**DESCRIPTION:**IBM Security ReaQta is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim’s Web browser within the security context of the hosting site.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/297165 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID:CVE-2023-33859
**DESCRIPTION:**IBM Security ReaQta could disclose sensitive information due to an observable login response discrepancy.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257697 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2023-33860
**DESCRIPTION:**IBM Security ReaQta allows web pages to be stored locally which can be read by another user on the system.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257698 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2023-35008
**DESCRIPTION:**IBM Security ReaQta does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257702 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM encourages customers to upgrade their systems promptly.

The IBM Security QRadar EDR operator can be upgraded automatically when new compatible versions are available. However, you can control whether an operator is upgraded automatically by setting an approval strategy.

Two approval strategies are available:

• Automatic (default) - New operator versions are installed automatically when they are available on the subscription channel.
• Manual - When a new operator version is available on the subscription channel, the subscription indicates that an update is available, but you must approve the update manually.

For more information about the manual installation process, view Installing QRadar EDR

Product|**Fix version
**
—|—
IBM Security QRadar EDR| 3.12.8

Workarounds and Mitigations

None