CVE-2015-2011: Command Injection

Published Oct 4, 2015

Updated

The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.

Affected Software

6 affected components

IBM QRadar Security Information and Event Manager=7.1.0

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21965817

Event History

Oct 4, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2011?

CVE-2015-2011 is considered a critical vulnerability due to its potential for remote authenticated users to execute arbitrary commands with root privileges.

How do I fix CVE-2015-2011?

To fix CVE-2015-2011, ensure that IBM QRadar SIEM is updated to version 7.1 MR2 Patch 11 IF02 or 7.2.5 Patch 4 or later.

Which versions of IBM QRadar SIEM are affected by CVE-2015-2011?

CVE-2015-2011 affects IBM QRadar SIEM versions 7.1 MR2 before Patch 11 IF02 and 7.2.0 through 7.2.4.

Can CVE-2015-2011 be exploited by unauthenticated users?

No, CVE-2015-2011 requires that the attacker is an authenticated user to exploit the vulnerability.

What type of vulnerability is CVE-2015-2011?

CVE-2015-2011 is a command injection vulnerability that allows remote authenticated users to execute commands with elevated privileges.