CVE-2024-22355: IBM Cloud Pak for Security Auth Bypass

CVE-2024-22355 Overview

CVE-2024-22355 is a weak password requirements vulnerability [CWE-521] affecting IBM QRadar Suite Products and IBM Cloud Pak for Security. The affected products do not enforce strong password policies by default. This configuration weakness lowers the effort required for attackers to compromise user accounts through brute-force or credential-guessing attacks. IBM tracks the issue as X-Force ID 280781.

Critical Impact
An attacker with network access to the QRadar Suite or Cloud Pak for Security console can compromise user accounts protected by weak passwords, potentially exposing sensitive security telemetry and case data.

Affected Products

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0
IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0
Deployments retaining default password policy settings

Discovery Timeline

2024-03-03 - CVE-2024-22355 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22355

Vulnerability Analysis

The vulnerability stems from insufficient default password policy controls in IBM QRadar Suite and IBM Cloud Pak for Security. Administrators are not required to configure strong password complexity, length, or history rules before user accounts can be created. Weak passwords are accepted at account creation and password reset.

The issue does not permit direct code execution or data manipulation. Instead, it broadens the attack surface for credential-based attacks against a platform that stores security-relevant data. Successful account compromise can expose investigations, log sources, and detection content managed by the suite.

Root Cause

The root cause is a missing security constraint in the default configuration [CWE-521: Weak Password Requirements]. IBM shipped the affected releases without enforcing strong password rules for local user accounts. Deployments that rely on defaults inherit this weakness unless administrators explicitly harden authentication settings.

Attack Vector

Exploitation requires network access to the QRadar Suite or Cloud Pak for Security authentication interface. No prior privileges or user interaction are needed. An attacker performs credential guessing, dictionary attacks, or password spraying against known or enumerated usernames. Attack complexity is elevated because the attacker must still identify valid accounts and weak credentials before authentication succeeds.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2024-22355 at the time of publication.

Detection Methods for CVE-2024-22355

Indicators of Compromise

Repeated failed authentication attempts against QRadar Suite or Cloud Pak for Security login endpoints from a single source or distributed sources
Successful logins immediately following a burst of failed attempts for the same account
Authentications from unexpected geographies, ASNs, or hours of the day for privileged accounts

Detection Strategies

Correlate authentication logs from the QRadar Suite console with directory-service events to identify password-spray patterns
Alert on account lockouts and repeated password failures against administrative accounts
Baseline typical login behavior for each console user and flag deviations in source IP, user agent, or session timing

Monitoring Recommendations

Forward IBM QRadar Suite and Cloud Pak for Security audit logs to a centralized analytics platform for long-term retention
Continuously review accounts that were created or modified with passwords that fail current policy strength checks
Monitor role assignments and permission changes on accounts that recently authenticated from new locations

How to Mitigate CVE-2024-22355

Immediate Actions Required

Apply the fix referenced in IBM Support Advisory 7129328 for affected QRadar Suite and Cloud Pak for Security versions
Enforce a strong password policy covering minimum length, complexity, history, and expiration for all local accounts
Reset passwords for existing accounts that do not meet the updated policy, prioritizing administrators and service accounts
Enable multi-factor authentication for all users with access to the QRadar Suite or Cloud Pak for Security consoles

Patch Information

IBM has published remediation guidance in IBM Support Advisory 7129328. Additional technical details are available from the IBM X-Force Vulnerability #280781 entry. Administrators should upgrade to the fixed release identified by IBM and apply the recommended configuration hardening.

Workarounds

Integrate the platform with an external identity provider that enforces enterprise password and MFA policies
Restrict network access to the console through VPN, bastion hosts, or IP allow-listing to limit exposure to credential attacks
Configure account lockout thresholds and progressive delay on repeated authentication failures

bash

# Configuration example
# Consult IBM Support Advisory 7129328 for the exact configuration syntax
# applicable to your QRadar Suite or Cloud Pak for Security release.