CVE-2023-38271 MEDIUM

CVE-2023-38271: IBM Cloud Pak System information disclosure

Vendor Ibm
Product Cloud Pak System
Weakness CWE-532 · Sensitive info in logs
Published January 25, 2025
Last update January 27, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.

Key dates

02Disclosure timeline

January 25, 2025 CVE published
January 27, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-52009 Git credentials are exposed in atlantis logs CVE-2024-13818 Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Files CVE-2022-20768 Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure Vulnerability CVE-2023-43043 IBM Maximo Application Suite information disclosure CVE-2021-21601