Home

Description

IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

PUBLISHED Reserved 2023-07-14 | Published 2026-02-04 | Updated 2026-02-05 | Assigner ibm




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-209 Generation of Error Message Containing Sensitive Information

Product status

2.3.4.0 (semver)
affected

2.3.4.1 (semver)
affected

2.3.4.1 Interim Fix 001 (semver)
affected

2.3.5.0
affected

2.3.6.0
affected

4.0.4.0
affected

4.0.5.0
affected

4.0.6.0
affected

4.0.7.0
affected

5.0.0.0
affected

5.0.1.0
affected

References

www.ibm.com/support/pages/node/7254419 vendor-advisory patch

cve.org (CVE-2023-38281)

nvd.nist.gov (CVE-2023-38281)

Download JSON