CVE-2021-20399 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-20399 PUBLISHED CVSS 7.099999904632568 HIGH

IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 196073.

EPSS 0.55% · 67.6th percentile

Risk Scores

CVSS v3.0

7.099999904632568

CVSS:3.0/AV:N/PR:L/C:H/UI:N/AC:L/S:U/I:N/A:L/RC:C/E:U/RL:O

EPSS Score

0.55%

67.6th percentile

Affected Products

Vendor	Product	Versions
ibm	qradar_security_information_and_event_manager	7.4.3, 7.3.3, 7.4.3
IBM	QRadar SIEM	7.4.0, 7.4.3, 7.3.3.Patch.8

Timeline

Jul 27, 2021 CVE Published
Jul 28, 2021 EPSS Score
Aug 4, 2021 EPSS Score
Sep 25, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Jan 20, 2022 EPSS Score
Feb 4, 2022 EPSS Score
Mar 19, 2022 EPSS Score
Apr 1, 2022 EPSS Score
Jul 16, 2022 EPSS Score
Sep 12, 2022 EPSS Score
Nov 10, 2022 EPSS Score

References

https://www.ibm.com/support/pages/node/6475263 url
ibm-qradar-cve202120399-xxe (196073) vdb
https://nvd.nist.gov/vuln/detail/CVE-2021-20399 advisory
https://www.ibm.com/support/pages/node/6464851 advisory
https://www.ibm.com/support/pages/node/6475265 advisory

Open in Interactive Console →