CVE-2023-38281: Multiple Vulnerabilities in IBM Cloud Pak System
IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38281?
CVE-2023-38281 is considered a high severity vulnerability due to the potential for attackers to exploit unsecured session cookies.
How do I fix CVE-2023-38281?
To fix CVE-2023-38281, ensure that the secure attribute is set on authorization tokens and session cookies in your IBM Cloud Pak System deployment.
What software versions are affected by CVE-2023-38281?
CVE-2023-38281 affects IBM Cloud Pak System versions up to 2.3.6.0 and certain versions of IBM OS Image for Red Hat Linux Systems.
What are the potential impacts of CVE-2023-38281?
The exploitation of CVE-2023-38281 may allow attackers to steal session cookies, potentially gaining unauthorized access to user accounts.
Is there a workaround for CVE-2023-38281?
A potential workaround for CVE-2023-38281 is to disable the use of unsecured links in applications that handle sensitive cookie values.