CVE-2023-37405: IBM Cloud Pak System information disclosure
First published: Thu Mar 27 2025(Updated: )
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stores sensitive data in memory, that could be obtained by an unauthorized user.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak System | <=2.3.3.0 (Intel) | |
| IBM Cloud Pak System | <=2.3.3.3 2.3.3.3 iFix1 | |
| IBM Cloud Pak System | <=2.3.3.4 | |
| IBM Cloud Pak System | <=2.3.3.5 | |
| IBM Cloud Pak System | <=2.3.3.6 2.3.3.6 IFix1 2.3.3.6 IFix2 | |
| IBM Cloud Pak System | <=2.3.4.0 | |
| IBM Cloud Pak System | <=2.3.4.1 | |
| IBM | <=Version(s) (Power) | |
| IBM Cloud Pak System | <=2.3.1.1 | |
| IBM Cloud Pak System | <=2.3.2.0 | |
| IBM Cloud Pak System | <=2.3.3.7 2.3.3.7 Ifix1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-37405?
CVE-2023-37405 has been rated as a significant vulnerability due to its potential exposure of sensitive data in memory.
How do I fix CVE-2023-37405?
To address CVE-2023-37405, update IBM Cloud Pak System to the latest version or apply the recommended security patches.
What versions of IBM Cloud Pak System are affected by CVE-2023-37405?
CVE-2023-37405 affects IBM Cloud Pak System versions 2.3.1.1 to 2.3.4.1, including specific iFix versions.
Can CVE-2023-37405 be exploited by an unauthorized user?
Yes, CVE-2023-37405 can be exploited by an unauthorized user to access sensitive data stored in memory.
What type of data is at risk with CVE-2023-37405?
CVE-2023-37405 exposes sensitive data that is stored in memory, which could include personal or proprietary information.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/title
- agent/severity
- agent/source
- agent/author
- agent/type
- agent/softwarecombine
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/event
- vendor/ibm
- canonical/ibm cloud pak system
- version/ibm cloud pak system/2.3.3.0 (intel)
- version/ibm cloud pak system/2.3.3.3 2.3.3.3 ifix1
- version/ibm cloud pak system/2.3.3.4
- version/ibm cloud pak system/2.3.3.5
- version/ibm cloud pak system/2.3.3.6 2.3.3.6 ifix1 2.3.3.6 ifix2
- version/ibm cloud pak system/2.3.4.0
- version/ibm cloud pak system/2.3.4.1
- canonical/ibm
- version/ibm/version(s) (power)
- version/ibm cloud pak system/2.3.1.1
- version/ibm cloud pak system/2.3.2.0
- version/ibm cloud pak system/2.3.3.7 2.3.3.7 ifix1