IBM Cloud Application Performance Management vulnerabilities

4 CVEs affecting IBM Cloud Application Performance Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4726, published 2021-03-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-4131, published 2019-07-11. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Application Performance Management (IBM Monitoring 8.1.4) could allow a remote attacker to induce the application to perform server-side DNS lookups of arbitrary domain names. IBM X-Force ID:…
CVE-2020-4719, published 2021-03-02. Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days. The IBM Cloud APM 8.1.4 server will issue a DNS request to resolve any hostname specified in the Cloud Event Management Webhook URL configuration definition. This could enable an authenticated user…
CVE-2020-4725, published 2021-03-02. Low severity, CVSS 3.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Monitoring (IBM Cloud APM 8.1.4 ) could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which could mislead another user. IBM X-Force…
CVE-2020-4726, published 2021-03-02. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975.