Cyber Resilience

CVE-2023-27290

Access Control in Ibm Observability With Instana 239-0 – 239-2

Public PoCAccess Control
Published
03 March 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.086 95th percentile
Risk Priority 79 floored blend · peak EPSS

Summary

CVE-2023-27290 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Ibm Observability With Instana. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-27290 is a missing authentication vulnerability affecting Docker-based datastores in IBM Observability with Instana versions 239-0 through 239-2, 241-0 through 241-2, and 243-0. The affected component fails to enforce any authentication requirement on these datastores, which are exposed in a manner consistent with the reported CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U and map to CWE-306.

An attacker positioned within the network can connect directly to the datastores and obtain read/write access without credentials or user interaction, enabling unauthorized data retrieval or modification.

IBM has published remediation guidance at https://www.ibm.com/support/pages/node/6959969 along with an X-Force entry at https://exchange.xforce.ibmcloud.com/vulnerabilities/248737; public exploit references also appear on Packet Storm.

EPSS for the CVE rose from lower values to a peak of 0.1738 before receding to the current 0.0850, indicating a period of increased exploitation interest well after the 2023 disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force…

more

ID: 248737.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-1264Same vendor: Ibm
CVE-2026-14976Same vendor: Ibm
CVE-2024-54176Same vendor: Ibm
CVE-2024-56469Same vendor: Ibm
CVE-2025-1495Same vendor: Ibm
CVE-2024-22326Same vendor: Ibm
CVE-2024-45075Same vendor: Ibm
CVE-2023-37404Same product: Ibm Observability With Instana
CVE-2026-14446Same vendor: Ibm
CVE-2026-14529Same vendor: Ibm

Affected Assets

ibm
observability with instana
243-0 · 239-0 — 239-2 · 241-0 — 241-2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.2.3
  • V6.4.4
  • V10.4.16
  • V12.1.3

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306

Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.

addresses: CWE-306

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-306

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

addresses: CWE-306

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-306

Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

PR.AA-01 partial match
prevents

Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.

PR.AA-05 partial match
prevents

Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.

PR.IR-01 partial match
prevents

Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.

prevents

Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.

mitigates

Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.

prevents

Security engineering principles insist on authentication and authorization for every critical function, eliminating entry points that lack any access control mechanism.

none

Requiring strong authentication and access-privilege enablement for remote connections ensures that critical functions cannot be invoked without proper verification, closing a gap that would otherwise allow unauthenticated use.

none

Mandatory use of access cards, biometrics, or two-factor authentication ensures that critical physical areas cannot be entered without proper authentication.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248585 OL 8 must require reauthentication when using the "sudo" command. prevents CWE-306
  • V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-306
RHEL 7 (2 rules)
  • V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-306
  • V-237635 The Red Hat Enterprise Linux operating system must require re-authentication when using the "sudo" command. prevents CWE-306
RHEL 8 (2 rules)
  • V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-306
  • V-237643 RHEL 8 must require re-authentication when using the "sudo" command. prevents CWE-306

References