PT-2023-25946 · Ibm · Ibm Observability With Instana

Published 2023-10-03 · Updated 2023-10-05 · CVE-2023-37404

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Observability with Instana versions 1.0.243 through 1.0.254

Description The issue allows an attacker on the network to execute arbitrary code on the host after a successful DNS poisoning attack.

Recommendations For versions 1.0.243 through 1.0.254, update to a version outside of this range to mitigate the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2023-37404

Affected Products

Ibm Observability With Instana

References · 8

• https://osv.dev/vulnerability/CVE-2023-37404 · Vendor Advisory
• https://ibm.com/support/pages/node/7041863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37404 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/259789 · Vendor Advisory
• https://t.me/cvenotify/59051 · Telegram Post
• https://twitter.com/CVEnew/status/1709388424375881946 · Twitter Post
• https://twitter.com/cracbot/status/1710075058323083428 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1709444485267050939 · Twitter Post