PT-2024-5152 · Ibm · Ibm Qradar Suite For+1

Ben Goodspeed + 8 · Published 2024-04-30 · Updated 2025-08-13 · CVE-2022-38386

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.11.0 IBM QRadar Suite for Software versions 1.10.12.0 through 1.10.19.0

Description: The issue is related to errors in security settings, specifically the failure to set the SameSite attribute for sensitive cookies. This could allow an attacker to obtain sensitive information using man-in-the-middle techniques. The vulnerability may be exploited by a remote attacker to gain access to confidential information.

Recommendations: For IBM Cloud Pak for Security (CP4S) versions 1.10.0.0 through 1.10.11.0, update the security settings to include the SameSite attribute for sensitive cookies. For IBM QRadar Suite for Software versions 1.10.12.0 through 1.10.19.0, update the security settings to include the SameSite attribute for sensitive cookies. As a temporary workaround, consider restricting access to sensitive cookies until the issue is resolved.

Fix

Weakness Enumeration

CWE-1275

Related Identifiers

BDU:2024-05699

CVE-2022-38386

Affected Products

Ibm Cloud Pak For Security

Ibm Qradar Suite For

References · 11

• https://osv.dev/vulnerability/CVE-2022-38386 · Vendor Advisory
• https://ibm.com/support/pages/node/7149811 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05699 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/233778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38386 · Security Note
• https://cybersecurity-help.cz/vulnerabilities/89072 · Note
• https://t.me/cvenotify/78774 · Telegram Post
• https://twitter.com/CVEnew/status/1785674774766620929 · Twitter Post
• https://vuldb.com/?id.262705 · Note
• https://t.me/cveNotify/132034 · Telegram Post
• https://t.me/cvenotify/78685 · Telegram Post