IBM Event Streams vulnerabilities

3 CVEs affecting IBM Event Streams, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-29792, published 2021-07-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1833, published 2018-12-18. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit…
CVE-2020-4662, published 2020-08-14. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. IBM X-Force ID: 186233.
CVE-2021-29792, published 2021-07-12. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cluster and gain privileges of another user. IBM X-Force ID:…