PT-2023-2248 · Ibm · Ibm Instana

Shahid Parvez

+1

·

Publicado

2023-03-03

·

Atualizado

2025-03-02

·

CVE-2023-27290

CVSS v2.0

9.4

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions IBM Instana (IBM Observability with Instana) versions 239-0 through 239-2 IBM Instana (IBM Observability with Instana) versions 241-0 through 241-2 IBM Instana (IBM Observability with Instana) version 243-0
Description The issue is related to Docker-based datastores for IBM Instana, which do not require authentication, allowing an attacker within the network to access the datastores with read/write access. This could enable a remote attacker to read or modify data.
Recommendations For IBM Instana (IBM Observability with Instana) versions 239-0 through 239-2, consider implementing authentication for Docker-based datastores to restrict access. For IBM Instana (IBM Observability with Instana) versions 241-0 through 241-2, consider implementing authentication for Docker-based datastores to restrict access. For IBM Instana (IBM Observability with Instana) version 243-0, consider implementing authentication for Docker-based datastores to restrict access. As a temporary workaround, consider restricting access to the Docker-based datastores to minimize the risk of exploitation.

Exploit

Correção

Missing Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2023-02004
CVE-2023-27290

Produtos afetados

Ibm Instana