CVE-2023-38012

Published: Jan 25, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: psirt@us.ibm.com (Secondary)

Description

IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Affected (6)

Products: Ibm: Cloud Pak System

Ibm

1 product

Cloud Pak System

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ibm Cloud Pak System	Version 2.3.3.6
Ibm Cloud Pak System	Version 2.3.3.6 ifix1
Ibm Cloud Pak System	Version 2.3.3.6 ifix2
Ibm Cloud Pak System	Version 2.3.3.7
Ibm Cloud Pak System	Version 2.3.3.7 ifix1
Ibm Cloud Pak System	Version 2.3.4.0

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

https://www.ibm.com/support/pages/node/7148474

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.