EUVD-2025-210954
GHSA-jx6h-wqj9-j7ph
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable QRadar interface (AV:N/AC:L) but requires a valid low-privilege account (PR:L); pure confidentiality exposure of backup data (C:H, I:N, A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.
AnalysisAI
IBM QRadar deployments running 7.5.0 through 7.5.0 UP15 Interim Fix 006 expose sensitive backup-file contents to any holder of a valid QRadar account, because those backup files are stored with incorrect permissions. Exploitation requires authentication (CVSS vector PR:L) but no administrative rights and no user interaction, and an attacker who satisfies that bar can read configuration, credential, or event data captured in the affected backups, yielding a high confidentiality impact (C:H) with no integrity or availability effect. This is a moderate-priority information-disclosure issue rather than a high-urgency emergency: no public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the authentication prerequisite plus the need for an unpatched interim-fix level are the principal limiting factors.
Technical ContextAI
The root cause class is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere): QRadar writes backup archives that aggregate sensitive appliance state, yet the file-system permissions assigned to those artifacts are broader than the set of principals that should be able to read them. Because the defect is in permission assignment on generated backup files rather than in a parsing or injection path, the attack surface is the local/adjacent file access granted to a normal authenticated account on the appliance. The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, low-complexity, low-privilege, no-interaction path with a scope-unchanged high confidentiality loss and no integrity or availability impact - a classic credentialed data-exposure profile rather than a remote-code-execution or tampering scenario. The CPE string cpe:2.3:a:ibm:qradar:*:*:*:*:*:*:*:* is version-wildcarded, so the authoritative version boundary is the prose range in the IBM bulletin: 7.5.0 through 7.5.0 UP15 Interim Fix 006, with later interim fixes containing the correction. No underlying third-party library or protocol is implicated; the exposure is entirely within QRadar's own backup generation and permission handling.
RemediationAI
Patch status is "Patch available per vendor advisory": IBM documents the fix in its support bulletin at https://www.ibm.com/support/pages/node/7286014, and the correct action is to upgrade the QRadar 7.5.0 deployment beyond 7.5.0 UP15 Interim Fix 006 to the latest interim fix level for the 7.5.0 stream, applying the vendor-supplied fix that corrects backup-file permissions (no exact fix version number is stated in the provided data, so confirm the target level against the IBM advisory before scheduling the change window). Because the flaw requires only an authenticated, non-privileged account, patch latency should be covered by compensating controls: audit and tighten file-system permissions (and any NFS/CIFS or shared-storage ACLs) on QRadar backup destinations so that only the designated backup/administrative service accounts can read them, accepting that over-restriction can break scheduled backup validation or restore tooling; reduce the blast radius by reviewing which non-administrative accounts exist on the appliance and disabling or narrowing any that are not business-required; and monitor/log reads of backup directories and archives so that any access by an ordinary user account is alerted on. Restricting network access to the appliance's management interfaces lowers the AV:N reachability but does not address an insider or already-provisioned authenticated user, which is the primary exploitation path here.
XML External Entity injection in IBM QRadar SIEM (versions 7.5.0 through 7.5.0 UP 15 IF005 and 7.6.0.0 through 7.6.0.1)
Command injection in IBM QRadar SIEM allows an authenticated privileged user to execute arbitrary OS commands at normal
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today