CVE-2015-2005: Infoleak

Published Feb 15, 2016

Updated

IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation.

Affected Software

6 affected components

IBM QRadar Security Information and Event Manager=7.1.0

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

Event History

Feb 15, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2005?

CVE-2015-2005 is classified as a medium severity vulnerability due to its potential to expose sensitive information.

How do I fix CVE-2015-2005?

To mitigate CVE-2015-2005, upgrade to IBM QRadar SIEM versions 7.1 MR2 Patch 12 or 7.2.5 Patch 6 or later.

What are the affected versions listed under CVE-2015-2005?

CVE-2015-2005 affects IBM QRadar SIEM versions 7.1.0, 7.2.0, 7.2.1, 7.2.2, 7.2.3, and 7.2.4.

What does CVE-2015-2005 vulnerability exploit?

CVE-2015-2005 exploits improper session expiration that can be leveraged by attackers at unattended workstations.

Who is at risk due to CVE-2015-2005?

Organizations using vulnerable versions of IBM QRadar SIEM are at risk of having sensitive information exposed.