CVE-2025-36050 in QRadar SIEM
Summary
by MITRE • 06/19/2025
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/24/2025
IBM QRadar SIEM version 7.5 through 7.5.0 Update Package 12 contains a vulnerability classified as information exposure that occurs when the system stores sensitive data in log files accessible to local users. This flaw represents a direct violation of the principle of least privilege and demonstrates inadequate data sanitization practices within the logging infrastructure. The vulnerability stems from the system's failure to properly redact or encrypt sensitive information before writing it to log files, creating potential attack vectors for malicious actors with local system access. According to CWE-200, this represents a weakness where information is disclosed to unauthorized actors, and the vulnerability aligns with ATT&CK technique T1070.001 for Indicator Removal on Host. The flaw exists in the logging subsystem where authentication tokens, user credentials, or other confidential data may be inadvertently written to persistent storage without proper access controls or encryption mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure, as local users with read access to log files could potentially extract sensitive authentication information, session tokens, or other confidential data that should remain protected. This creates a significant risk for organizations relying on QRadar SIEM for security monitoring, as attackers who gain local access to the system could leverage this information to escalate privileges or conduct lateral movement within the network. The vulnerability affects the integrity and confidentiality of the security information and event management system, potentially compromising the entire security posture of organizations using affected versions. Attackers could use the extracted information to impersonate legitimate users or gain unauthorized access to other systems within the organization's infrastructure.
Organizations should immediately implement mitigations including restricting local file system access to log directories, implementing proper log file access controls, and ensuring that sensitive information is not written to persistent storage in plain text format. System administrators should configure log rotation policies with appropriate permissions and consider implementing centralized log management solutions that properly sanitize data before storage. The vulnerability requires immediate attention as it represents a critical security weakness that could be exploited by any local user with basic read permissions. Security teams should conduct comprehensive audits of log file contents and implement automated monitoring for unauthorized access attempts to sensitive log files. Regular security assessments should include verification of log file contents and access controls to prevent similar information exposure scenarios. The remediation process should involve updating to the latest available patches from IBM and implementing additional access controls to prevent unauthorized local access to system log files.