Several locations in the QRadar Console allow attackers to insert JavaScript thus modifying the UI functionality.
CVE-ID: CVE-2015-1995 **
Description:IBM QRadar is vulnerable to cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victimโs Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victimโs cookie based authentication credentials. **
CVSS Base Score: 4.3**
CVSS Temporal Score:** See https://exchange.xforce.ibmcloud.com/vulnerabilities/103905 for the current score**
CVSS Environmental Score:** Undefined*
CVSS Vector:** AV:N/AC:M/Au:N/C:N/I:P/A:N
ยท IBM QRadar SIEM 7.2.n
ยท IBM QRadar SIEM 7.1.n
ยท IBM QRadar/QRM/QVM/QRIF 7.2.5 Patch 6
ยท IBM QRadar SIEM 7.1 MR2 Patch 12
None