CVE-2016-9750

Vulnerability

IBM QRadar SIEM versions 7.2.x and 7.3.x store user credentials in plain, clear text [1]. The vulnerability resides in the credential storage mechanism. An attacker must first be an authenticated user with file system access to exploit this issue [1].

Exploitation

An authenticated user with access to the QRadar file system can read stored credentials in plaintext [1]. The attack requires network access (AV:N) but high complexity (AC:H) and low privileges (PR:L) with no user interaction (UI:N) [1]. The attacker does not need to be on the same network segment; remote access over the network is sufficient [1].

Impact

Successful exploitation results in high confidentiality impact: the attacker obtains plaintext user or system passwords [1]. This can lead to privilege escalation or unauthorized access to other systems that QRadar integrates with [1].

Mitigation

No workarounds or mitigations are documented in the reference [1]. IBM has not released a security patch to address this issue in the referenced advisory. Affected administrators should monitor IBM's support portal for future updates and restrict file system access to trusted users only, as per the security advisory.