CVE-2023-27290
Last modified
CVE-2023-27290 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. EPSS estimates a 8.57% chance of exploitation in the next 30 days.
Description
Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Observability With Instana | >= 239-0, <= 239-2 |
| Ibm | Observability With Instana | >= 241-0, <= 241-2 |
| Ibm | Observability With Instana | 243-0 |
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/248737VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6959969Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/248737VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6959969Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-27290?
How severe is CVE-2023-27290?
How do I fix CVE-2023-27290?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-2728Users may be able to launch containers that bypass the mount…6.5
- CVE-2023-27283IBM Aspera Orchestrator 4.0.1 could allow a remote attacker …5.3
- CVE-2023-27284IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vuln…9.8
- CVE-2023-27285IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 is vulne…7.8
- CVE-2023-27286IBM Aspera Cargo 4.2.5 and IBM Aspera Connect 4.2.5 are vuln…9.8
- CVE-2023-2729Use of insufficiently random values vulnerability in User Ma…7.5
- CVE-2023-27291IBM Watson CP4D Data Stores 4.6.0, 4.6.1, 4.6.2, and 4.6.3 d…7.5
- CVE-2023-27292An open redirect vulnerability exposes OpenCATS to template …5.4
- CVE-2023-27293Improper neutralization of input during web page generation …6.1
- CVE-2023-27294Improper neutralization of input during web page generation …5.4
- CVE-2023-27295Cross-site request forgery is facilitated by OpenCATS failur…5.4
- CVE-2023-27296Deserialization of Untrusted Data vulnerability in Apache So…8.8
Are you affected by CVE-2023-27290?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST