CVE-2019-4594: 
IBM QRadar SIEM vulnerability analysis and mitigation

IBM QRadar versions 7.3.0 to 7.3.3 Patch 2 contained a security vulnerability (CVE-2019-4594) related to HTTP Strict Transport Security implementation. The vulnerability was discovered and disclosed in April 2020, affecting IBM QRadar Security Information and Event Manager (SIEM) systems (IBM Advisory, NVD).

The vulnerability stems from a failure to properly enable HTTP Strict Transport Security in the affected QRadar versions. This security flaw received a CVSS v3.1 Base Score of 5.9 (Medium), with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The scoring indicates that while the vulnerability requires high attack complexity, it can be exploited remotely without requiring privileges or user interaction (NVD, IBM Advisory).

The vulnerability could allow a remote attacker to obtain sensitive information through man-in-the-middle techniques. The impact is primarily focused on confidentiality, with no direct effect on system integrity or availability (IBM Advisory).

The vulnerability requires high attack complexity to exploit, though it can be accessed remotely without authentication. An attacker would need to successfully execute man-in-the-middle techniques to exploit this vulnerability (NVD).

IBM released several fixes for this vulnerability including QRadar/QRM/QVM/QNI 7.4.0 GA (SFS), QRadar/QRM/QVM/QRIF/QNI 7.3.3 Patch 2 (SFS), QRadar/QRM/QVM/QRIF/QNI 7.3.2 Patch 7(SFS), and QRadar Incident Forensics 7.4.0 (ISO and SFS). No temporary workarounds were provided (IBM Advisory).