CVE-2022-38382

Published: Aug 13, 2024Modified: Jun 17, 2026

4.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Exploitability: 2.3 / Impact: 1.4

Source: NVD

Description

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information. IBM X-Force ID: 233672.

Affected (2)

Products: Ibm: Cloud Pak For Security, Qradar Suite

2 products

Cloud Pak For Security

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ibm Cloud Pak For Security	From 1.10.0.0 to 1.10.11.0
Ibm Qradar Suite	From 1.10.12.0 to 1.10.23.0

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/233672

Source: psirt@us.ibm.com

VDB Entry

https://www.ibm.com/support/pages/node/7165286

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.