IBM QRadar SOAR Plugin App versions 1.0.0 through 5.6.0 may allow remote attackers to traverse directories on the system. By sending a specially crafted URL request containing ‘dot dot’ sequences (/../), an attacker could potentially view arbitrary files on the system. This vulnerability poses a risk to the confidentiality of sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-36114 |
Exploitation
To exploit this vulnerability, an attacker can craft a URL that includes directory traversal sequences, allowing them to access files outside the intended directory structure. This can be done by sending the malicious URL to the affected system, which processes the request and reveals sensitive files.
Affected Products
- IBM QRadar SOAR Plugin App 1.0.0: Initial version vulnerable to directory traversal.
- IBM QRadar SOAR Plugin App 5.6.0: Latest version in the affected range still susceptible to exploitation.
Mitigation
To mitigate this vulnerability, it is recommended to update the IBM QRadar SOAR Plugin App to the latest version that addresses this issue. Additionally, implementing proper input validation and sanitization can help prevent directory traversal attacks.