PT-2024-12764 · Ibm · Ibm Openpages With Watson

Published 2024-01-18 · Updated 2024-01-24 · CVE-2023-38738

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM OpenPages with Watson versions 8.3 through 9.0

Description The issue provides weaker than expected security in an OpenPages environment using Native authentication. An attacker with access to the OpenPages database could exploit this weakness through a series of specially crafted steps and gain unauthorized access to other OpenPages accounts.

Recommendations For versions 8.3 and 9.0, consider disabling Native authentication until a patch is available to prevent unauthorized access. Restrict access to the OpenPages database to minimize the risk of exploitation. As a temporary workaround, limit the use of OpenPages accounts to essential tasks only until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-257

Related Identifiers

CVE-2023-38738

Affected Products

Ibm Openpages With Watson

References · 8

• https://osv.dev/vulnerability/CVE-2023-38738 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/262594 · Vendor Advisory
• https://ibm.com/support/pages/node/7107775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38738 · Security Note
• https://twitter.com/VulmonFeeds/status/1748232183293030554 · Twitter Post
• https://t.me/cvenotify/68600 · Telegram Post
• https://twitter.com/CVEnew/status/1748165362045079663 · Twitter Post
• https://t.me/cvenotify/67953 · Telegram Post