CVE-2023-38005: Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System[, ]

Published Feb 6, 2026
·
Updated

IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could allow an authenticated user to perform unauthorized tasks due to improper access controls.

Other sources

IBM Cloud Pak System could allow an authenticated user to perform unauthorized tasks due to improper access controls.

— IBM

Affected Software

10 affected components
IBM Cloud Pak System<=2.3.3.6
IBM Cloud Pak System<=2.3.3.7
IBM Cloud Pak System<=2.3.4.0
IBM Cloud Pak System<=2.3.4.1
IBM Cloud Pak System<=2.3.5.0
IBM Cloud Pak System=2.3.3.6
IBM Cloud Pak System=2.3.3.7
IBM Cloud Pak System=2.3.4.0
IBM Cloud Pak System=2.3.4.1
IBM Cloud Pak System=2.3.5.0

Remediation

Information

This Security Bulletin applies to IBM Cloud Pak System, IBM Cloud Pak System Software, IBM Cloud Pak System Software Suite. For Intel releases, IBM strongly recommends addressing this vulnerability now by upgrading to  v2.3.4.1 Interim Fix 1 or latest upgrade to Cloud Pak System 2.3.6.1 , For Power, contact IBM Support. For unsupported versions the recommendation is to upgrade/migrate to supported version of the product.

Event History

Feb 6, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Feb 17, 2026
CVE Published
via MITRE·09:49 PM
Data Sourced
via MITRE·09:49 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:18 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2023-38005?

CVE-2023-38005 has a medium severity rating due to improper access control vulnerabilities that may allow unauthorized access.

2

How do I fix CVE-2023-38005?

To mitigate CVE-2023-38005, update your IBM Cloud Pak System to the latest version that addresses the access control vulnerabilities.

3

Who is affected by CVE-2023-38005?

CVE-2023-38005 affects IBM Cloud Pak System versions 2.3.3.6 to 2.3.5.0.

4

What type of vulnerability is CVE-2023-38005?

CVE-2023-38005 is characterized as an improper access control and information exposure vulnerability.

5

Can CVE-2023-38005 be exploited by authenticated users?

Yes, CVE-2023-38005 can be exploited by authenticated users who may perform unauthorized tasks due to the access control issues.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203