DNS Query Manipulation in IBM Cloud APM Server

CVE-2020-4719

What is CVE-2020-4719?

The IBM Cloud APM 8.1.4 server is susceptible to a vulnerability where it processes DNS requests for any hostname specified in the Cloud Event Management Webhook URL configuration. This issue allows an authenticated user with admin privileges to create DNS query strings that do not correspond to valid hostnames, potentially leading to further security implications. Proper validation measures should be enforced to mitigate the risk associated with untrusted inputs.

References