IBM EUVD-2025-208852

While the CVSS score of 5.4 (Medium) reflects moderate severity, the real-world risk assessment reveals several mitigating factors. The attack requires valid credentials (PR:L) and user interaction (UI:R), limiting the threat model to insider threats or compromised accounts combined with social engineering. The vulnerability does not directly impact confidentiality or availability of the SIEM system itself—only low-impact integrity concerns (I:L) and low confidentiality impact (C:L)—meaning it cannot be weaponized for wholesale data exfiltration or denial of service. The fact that no EPSS score is noted in the intelligence and KEV status is absent suggests exploitation likelihood is low relative to the CVSS rating. However, for a critical infrastructure tool like SIEM, even low-impact code execution in the administrative console warrants immediate patching, as it could be chained with other vulnerabilities or used for persistence mechanisms. Organizations should prioritize this as medium priority rather than critical, but should not delay remediation beyond standard patch cycles.

An attacker with valid QRadar credentials (such as a disgruntled analyst or an account compromised via phishing) crafts a malicious URL containing JavaScript payload in a Web UI parameter and sends it to another QRadar administrator via email or chat, embedding the payload in a seemingly legitimate link to a QRadar report. When the administrator clicks the link and the page renders, the injected JavaScript executes in their browser context with the same privileges, allowing the attacker to steal their session token, modify alert thresholds to suppress critical security events, or redirect future logins to a phishing page. Since the attack requires user interaction (UI:R) and valid authentication (PR:L), it is not a zero-click vulnerability, but the relatively low complexity (AC:L) and network-accessible vector (AV:N) make it a viable secondary payload in a multi-stage attack chain against enterprise SOC teams.