CVE-2020-4280

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 68.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-08 · updated 2026-06-17
Weakness: CWE-502

Description

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 176140.

Affected products

IBM QRadar SIEM: from 7.3.0 through 7.3.3; from 7.4.0 through 7.4.1; 7.3.3-p1, 7.3.3-p2, 7.3.3-p3, 7.3.3-p4

References

http://packetstormsecurity.com/files/159589/QRadar-RemoteJavaScript-Deserialization.html
http://seclists.org/fulldisclosure/2020/Oct/18
https://exchange.xforce.ibmcloud.com/vulnerabilities/176140
https://www.ibm.com/support/pages/node/6344079
http://packetstormsecurity.com/files/159589/QRadar-RemoteJavaScript-Deserialization.html
http://seclists.org/fulldisclosure/2020/Oct/18
https://exchange.xforce.ibmcloud.com/vulnerabilities/176140
https://www.ibm.com/support/pages/node/6344079

Get alerted when CVE-2020-4280 or the next vulnerability affects your stack