CVE-2015-4930: Command Injection

Published Oct 4, 2015

Updated

IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.

Affected Software

6 affected components

IBM QRadar Security Information and Event Manager=7.1.0

IBM QRadar Security Information and Event Manager=7.2.0

IBM QRadar Security Information and Event Manager=7.2.1

IBM QRadar Security Information and Event Manager=7.2.2

IBM QRadar Security Information and Event Manager=7.2.3

IBM QRadar Security Information and Event Manager=7.2.4

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21965813

Event History

Oct 4, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4930?

CVE-2015-4930 is considered a high severity vulnerability due to potential remote execution of arbitrary commands with root privileges.

How do I fix CVE-2015-4930?

To fix CVE-2015-4930, apply Patch 11 IF02 for QRadar SIEM 7.1 MR2 or upgrade to QRadar SIEM 7.2.5 Patch 4 or later versions.

Who is affected by CVE-2015-4930?

CVE-2015-4930 affects IBM QRadar SIEM versions 7.1 MR2 before Patch 11 IF02 and 7.2.x prior to 7.2.5 Patch 4.

What type of attack does CVE-2015-4930 enable?

CVE-2015-4930 enables remote authenticated users to execute arbitrary commands on the system as root.

Is there a workaround for CVE-2015-4930?

There is no documented workaround for CVE-2015-4930; applying the appropriate patches is the only mitigation.