CVE-2016-2871: High severity ibm qradar security information and event manager vulnerability
Published Nov 30, 2016
·Updated
IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information by reading a configuration file.
Affected Software
8 affected components
IBM QRadar Security Information and Event Manager<=7.1.0
IBM QRadar Security Information and Event Manager=7.2.0
IBM QRadar Security Information and Event Manager=7.2.1
IBM QRadar Security Information and Event Manager=7.2.2
IBM QRadar Security Information and Event Manager=7.2.3
IBM QRadar Security Information and Event Manager=7.2.4
IBM QRadar Security Information and Event Manager=7.2.5
IBM QRadar Security Information and Event Manager=7.2.6
Remediation
Patch Available
Event History
Nov 30, 2016
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2871?
CVE-2016-2871 has been assigned a medium severity level due to the potential for local users to access sensitive information.
2
How do I fix CVE-2016-2871?
To fix CVE-2016-2871, upgrade to IBM QRadar SIEM version 7.1 MR2 Patch 13 or version 7.2.7 or higher.
3
What does CVE-2016-2871 exploit?
CVE-2016-2871 exploits the cleartext storage of passwords in configuration files.
4
Who is affected by CVE-2016-2871?
CVE-2016-2871 affects users of IBM QRadar SIEM versions prior to MR2 Patch 13 and 7.2.7.
5
What impact does CVE-2016-2871 have on my system?
CVE-2016-2871 allows unauthorized local users to read sensitive information from configuration files.