SB2024031330 - Multiple vulnerabilities in IBM Observability with Instana

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024031330

SB2024031330 - Multiple vulnerabilities in IBM Observability with Instana

Published: March 13, 2024 Updated: October 25, 2024

Security Bulletin ID SB2024031330
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2023-37903)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to unspecified error. An attacker with code execution primitive inside the context of vm2 sandbox can use the Node.js custom inspect function to escape the sandbox and run arbitrary code.


2) Security features bypass (CVE-ID: CVE-2023-37466)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of user-supplied input within the Promise handler. A remote attacker can pass specially crafted data to the application, bypass sanitization with `@@species` accessor property to escape the sandbox and run arbitrary code.


Remediation

Install update from vendor's website.

References