IBM Observability With Instana vulnerabilities

2 CVEs affecting IBM Observability With Instana, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-37404, published 2023-10-04.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-27290, published 2023-03-03. Critical severity, CVSS 9.1. EPSS: 8.6% chance of exploitation in the next 30 days. Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within…
• CVE-2023-37404, published 2023-10-04. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Observability with Instana 1.0.243 through 1.0.254 could allow an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack. IBM X-Force ID: 259789.