CVE-2023-38272

Published: Mar 27, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the network to obtain sensitive information from CLI arguments.

Affected (13)

Products: Ibm: Cloud Pak System

Ibm

1 product

Cloud Pak System

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Ibm Cloud Pak System	Version 2.3.1.1
Ibm Cloud Pak System	Version 2.3.3.0
Ibm Cloud Pak System	Version 2.3.3.3
Ibm Cloud Pak System	Version 2.3.3.3 ifix1
Ibm Cloud Pak System	Version 2.3.3.4
Ibm Cloud Pak System	Version 2.3.3.5
Ibm Cloud Pak System	Version 2.3.3.6
Ibm Cloud Pak System	Version 2.3.3.6 ifix1
Ibm Cloud Pak System	Version 2.3.3.6 ifix2
Ibm Cloud Pak System	Version 2.3.3.7
Ibm Cloud Pak System	Version 2.3.3.7 ifix1
Ibm Cloud Pak System	Version 2.3.4.0
Ibm Cloud Pak System	Version 2.3.4.1

Related CWEs

CWE-300

Channel Accessible by Non-Endpoint

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

References (1)

https://www.ibm.com/support/pages/node/7229212

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.