CVE-2023-38281

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38281

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

I

BM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

References
Link Resource
https://www.ibm.com/support/pages/node/7254419 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ibm:cloud_pak_system:2.3.4.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.4.1:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.4.1:ifix1:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.6.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:5.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:5.0.1.0:*:*:*:*:*:*:*
History

25 Feb 2026, 14:47

Type Values Removed Values Added
References () https://www.ibm.com/support/pages/node/7254419 - () https://www.ibm.com/support/pages/node/7254419 - Vendor Advisory
Summary
  • (es) IBM Cloud Pak System no establece el atributo seguro en los tokens de autorización o las cookies de sesión. Los atacantes podrían obtener los valores de las cookies enviando un enlace http:// a un usuario o insertando este enlace en un sitio al que el usuario acceda. La cookie se enviará al enlace inseguro y el atacante podrá entonces obtener el valor de la cookie espiando el tráfico.
CPE cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:5.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.4.1:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.4.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.6.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.5.0:-:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.4.1:ifix1:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.5.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:4.0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:os_image_for_red_hat_linux_systems:5.0.1.0:*:*:*:*:*:*:*
First Time Ibm os Image For Red Hat Linux Systems
Ibm
Ibm cloud Pak System

04 Feb 2026, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 21:15

Updated : 2026-02-25 14:47

NVD link : CVE-2023-38281

Mitre link : CVE-2023-38281

CVE.ORG link : CVE-2023-38281

JSON object : View

Products Affected

ibm

CWE
CWE-209

Generation of Error Message Containing Sensitive Information