CVE-2020-4280

Related Files

QRadar RemoteJavaScript Deserialization

Posted Oct 19, 2020

Authored by Securify B.V.

A Java deserialization vulnerability exists in the QRadar RemoteJavaScript Servlet. An authenticated user can call one of the vulnerable methods and cause the Servlet to deserialize arbitrary objects. An attacker can exploit this vulnerability by creating a specially crafted (serialized) object, which amongst other things can result in a denial of service, change of system settings, or execution of arbitrary code. This issue was successfully verified on QRadar Community Edition version 7.3.1.6 (7.3.1 Build 20180723171558).

tags | exploit, java, denial of service, arbitrary

advisories | CVE-2020-4280

SHA-256 | 0f8533fd0513dc351a0c6bb51c862f6156842187d3e72a38a9b78ea74a771878

Download | Favorite | View