CVE-2022-22345

IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in…

Medium4.8EPSS 1.8%

Published: 27 Apr 2022
Updated: 16 Sept 2024
Reserved: 3 Jan 2022
Assigned by: ibm

Description

IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 220041.

Timeline

2022
3 Jan 2022
3 Jan 2022
ID reserved
By ibm
27 Apr 20224 months later
27 Apr 2022· 4 months later
Published
2024
16 Sept 20242 years later
16 Sept 2024· 2 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-22345, by who scored it
Scored by	CVSS	Score	Vector
ibmCNA (assigner)	3.0	Medium4.8	CVSS:3.0/C:L/AV:N/AC:L/I:L/PR:H/S:C/A:N/UI:R/RL:O/E:H/RC:C
NVDNVD · Modified	3.1	Medium4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 1.8% · top 21% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

Cross-Site Scripting
CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

IBM · QRadar SIEM
- affected 7.3.3
- affected 7.4.3
- affected 7.5.0

References (2)

https://www.ibm.com/support/pages/node/6574453 (opens in a new tab)x_refsource_CONFIRMx_transferred
ibm-qradar-cve202222345-xss (220041) (opens in a new tab)vdb-entryx_refsource_XFx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-22345](https://trackcve.app/badge/CVE-2022-22345.svg)](https://trackcve.app/cve/CVE-2022-22345)

Record last updated 16 Sept 2024, 17:02 UTC.