CVE-2025-36138
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. An authenticated user can embed arbitrary JavaScript code in the Web UI, altering its intended functionality.
Risk Assessment
This may lead to credential disclosure within a trusted session and allow manipulation of the interface by an attacker with a valid account.
Recommendation
Update IBM QRadar SIEM to a version containing the fix (beyond 7.5.0 Update Pack 13 Independent Fix 02) and restrict Web UI access to trusted networks.
Other vulnerabilities in IBM QRadar SIEM
See all- CVE-2016-2878High
Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
- CVE-2016-2876High
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, making it easier for remote authenticated users to obtain root access by leveraging a command-injection issue.
- CVE-2016-2873High
SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-2871High
IBM QRadar SIEM versions 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 use cleartext storage for unspecified passwords, allowing local users to obtain sensitive information by reading a configuration file.
- CVE-2015-4930High
IBM QRadar SIEM version 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges by leveraging admin access.
- CVE-2015-2016High
Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
- CVE-2015-2011High
The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
- CVE-2024-56464Low
IBM QRadar SIEM versions 7.5 through 7.5.0 UP14 IF01 is affected by an information disclosure vulnerability involving exposure of directory information. IBM has addressed this vulnerability in the latest update.
- CVE-2025-36170Medium
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
- CVE-2025-36007High
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 are vulnerable to privilege escalation due to improper privilege assignment to an update script.
Original NVD description (English source)
IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS