Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-43057
CVE-2023-43057:
IBM QRadar SIEM vulnerability analysis and mitigation
Overview
IBM QRadar SIEM 7.5.0 was identified with a cross-site scripting vulnerability (CVE-2023-43057), discovered in November 2023. This vulnerability affects versions from 7.5.0 through versions prior to 7.5.0 UP7 IF02. The vulnerability was reported by security researchers Dominik Baucke and Gerbert Roitburd from usd AG (IBM Advisory).
Technical details
The vulnerability allows users to embed arbitrary JavaScript code in the Web UI, which can alter the intended functionality of the application. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction to exploit (NVD).
Impact
The primary impact of this vulnerability is the potential disclosure of credentials within a trusted session. The cross-site scripting vulnerability could allow attackers to steal user session information and potentially gain unauthorized access to the system (IBM Advisory).
Mitigation and workarounds
IBM has released a fix for this vulnerability in version 7.5.0 UP7 IF02. Organizations are strongly encouraged to update their systems promptly to this version. No temporary workarounds have been identified for this vulnerability (IBM Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management