CVE-2025-25022 PUBLISHED

IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure

Assigner: ibm
Reserved: 31.01.2025 Published: 03.06.2025 Updated: 04.06.2025

IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could allow an unauthenticated user in the environment to obtain highly sensitive information in configuration files.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.6

Product Status

Vendor IBM
Product QRadar Suite Software
Versions Default: unaffected
  • affected from 1.10.12.0 to 1.11.2.0 (incl.)
Vendor IBM
Product Cloud Pak for Security
Versions Default: unaffected
  • affected from 1.10.0.0 to 1.10.11.0 (incl.)

Solutions

IBM strongly encourages customers to update their systems promptly.

Please upgrade to at least version 1.11.3.0 according to the following instructions:

https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=installing

https://www.ibm.com/docs/en/cloud-paks/cp-security/1.11?topic=upgrading

Credits

  • John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed, Dawid Bak finder

References

Problem Types

  • CWE-260 Password in Configuration File CWE