IBM reports multiple flaws in QRadar Suite, including one critical
Take action: Your IBM QRadar Suite Software stores passwords from configuration files which can be accessed without authentication. Make sure that QRadar is isolated and accessible only from trusted networks. Then patch to version 1.11.3.0 or later ASAP - because isolation can be broken and malicious insiders can still exploit the flaw.
Learn More
IBM has issued a security bulletin addressing multiple vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms, with the most severe flaw allowing unauthenticated attackers to access configuration files containing passwords and other critical system information.
Vulnerabilities summary
- CVE-2025-25022 (CVSS score 9.6) - Password in Configuration File and could facilitate privilege escalation or broader system compromise. It allows unauthenticated users in the environment to obtain highly sensitive information stored in configuration files. This vulnerability stems from passwords being stored in configuration files.
- CVE-2025-25021 (CVSS score 7.2) - Improper Control of Generation of Code and potentially allows attackers to run malicious commands within administrative contexts. It enables privileged users to execute arbitrary code through improper code generation in case management scripts.
- CVE-2025-25020 (CVSS score 6.5) - Improper Validation of Specified Type of Input and could be exploited to crash critical security services. It allows authenticated users to cause denial of service attacks due to improper validation of API data input.
- CVE-2025-25019 (CVSS score 4.8) - Insufficient Session Expiration. It's an insufficient session expiration where the software fails to invalidate sessions after logout. It enables user impersonation attacks through persistent session tokens.
- CVE-2025-1334 (CVSS score 4.0) - Use of Web Browser Cache Containing Sensitive Information. It allows web pages to be stored locally and read by other users on the same system. This vulnerability exposes sensitive data in shared environments.
The vulnerabilities affect QRadar Suite Software versions 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0
Users should update their systems to QRadar Suite Software version 1.11.3.0 or later. No workarounds or temporary mitigations are available.
