PT-2026-5864 · Ibm · Ibm Cloud Pak System

Published 2026-02-04 · Updated 2026-02-25 · CVE-2023-38281

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System (affected versions not specified)

Description The software does not set the secure attribute on authorization tokens or session cookies. This could allow attackers to obtain cookie values by sending an insecure HTTP link to a user or by planting such a link on a site the user visits. The cookie will be sent to the insecure link, enabling the attacker to capture the cookie value by monitoring network traffic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2023-38281

Affected Products

Ibm Cloud Pak System

References · 5

• https://osv.dev/vulnerability/CVE-2023-38281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38281 · Security Note
• https://t.me/cveNotify/153156 · Telegram Post
• https://twitter.com/CVEnew/status/2019182764793426053 · Twitter Post
• https://ibm.com/support/pages/node/7254419 · Patch, Vendor Advisory