IBM QRadar Wincollect Escalation of Privilege (CVE-2020-4485 & CVE-2020-4486)

[[correlate]]

Content source

https://labs.redyops.com/index.php/2020/09/11/ibm-qradar-wincollect-escalation-of-privileges-cve-2020-4485-cve-2020-4486/

An Elevation of Privilege (EoP) exists in IBM QRadar Wincollect 7.2.0 – 7.2.9 . The vulnerability described gives the ability to a low privileged user to delete any file from the System and disable the Wincollect service. This arbitrary delete vulnerability can be leveraged in order to gain access as NT AUTHORITY\SYSTEM. During the exploitation, the attacker disables the Wincollect service.

IBM QRadar Wincollect Escalation of Privilege

Writeup for IBM QRadar Wincollect CVE-2020-4485 and CVE-2020-4486 .

labs.redyops.com