CVE-2020-4512: 
IBM QRadar SIEM vulnerability analysis and mitigation

IBM QRadar SIEM versions 7.3.0 to 7.3.3 Patch 3 and 7.4.0 to 7.4.0 Patch 2 were found to contain a command injection vulnerability, identified as CVE-2020-4512. The vulnerability was discovered and assigned on December 30, 2019, with public disclosure occurring on July 13, 2020. This security flaw could potentially allow remote privileged users to execute arbitrary commands on affected systems (IBM Security).

The vulnerability has been assigned a CVSS Base score of 9.1, indicating critical severity. The CVSS Vector is (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), which indicates that the vulnerability is network-accessible, requires low attack complexity, needs high privileges, requires no user interaction, and can affect scope with potential for high impacts on confidentiality, integrity, and availability (IBM Security).

If successfully exploited, this vulnerability could allow a remote privileged attacker to execute arbitrary commands on the affected QRadar SIEM systems. This could potentially lead to complete system compromise, affecting the confidentiality, integrity, and availability of the security information and event management system (IBM Security).

The vulnerability requires high privileges for exploitation but can be accessed remotely with low attack complexity. No user interaction is required for exploitation, making it particularly concerning for systems exposed to privileged users (IBM Security).

IBM has released patches to address this vulnerability. Users should upgrade to QRadar/QRM/QVM/QRIF/QNI 7.4.0 Patch 3 for version 7.4 systems, or QRadar/QRM/QVM/QRIF/QNI 7.3.3 Patch 4 for version 7.3 systems. No workarounds or alternative mitigations are available (IBM Security).