CVE-2017-1723

IBM Security QRadar SIEM 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 134812.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:qradar_security_information_and_event_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p10:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p11:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p3:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p4:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p5:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p6:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p7:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p8:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.2.8:p9:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.3.1:p2:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:ibm:qradar_incident_forensics:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p10:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p11:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p3:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p4:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p5:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p6:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p7:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p8:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.2.8:p9:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_incident_forensics:7.3.1:p2:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:ibm:qradar_network_insights:*:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p10:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p11:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p3:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p4:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p5:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p6:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p7:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p8:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.2.8:p9:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.3.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.3.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.3.1:p1:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_network_insights:7.3.1:p2:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-26 14:29

Updated : 2024-02-04 19:46


NVD link : CVE-2017-1723

Mitre link : CVE-2017-1723

CVE.ORG link : CVE-2017-1723


JSON object : View

Products Affected

ibm

  • qradar_security_information_and_event_manager
  • qradar_network_insights
  • qradar_incident_forensics
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')