title: IBM QRadar Suite information dislosure
description: IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances.  IBM X-Force ID:  272533.
problem types: CWE-300 Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
affected:
{
defaultStatus: unaffected
product: QRadar Suite Products
vendor: IBM
versions:
lessThanOrEqual: 1.10.18.0, status: affected, version: 1.10.12.0, versionType: semver
}
{
defaultStatus: unaffected
product: Cloud Pak for Security
vendor: IBM
versions:
lessThanOrEqual: 1.10.11.0, status: affected, version: 1.10.0.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL