CVE-2023-38271: IBM Cloud Pak System information disclosure
First published: Wed Jul 31 2024(Updated: )
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.
Credit: psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak System | >=2.3.3.0<=2.3.3.7 | |
| IBM Cloud Pak System | <=2.3.3.0 | |
| IBM Cloud Pak System | <=2.3.3.3, 2.3.3.3iFix1 | |
| IBM Cloud Pak System | <=2.3.3.4 | |
| IBM Cloud Pak System | <=2.3.3.5 | |
| IBM Cloud Pak System | <=2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2 | |
| IBM | <=Version(s) (Power) | |
| IBM Cloud Pak System | <=2.3.3.7, 2.3.3.7 iFix1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-38271?
The severity of CVE-2023-38271 is considered high due to the potential for an authenticated user to access sensitive information from log files.
How do I fix CVE-2023-38271?
To fix CVE-2023-38271, update your IBM Cloud Pak System to version 2.3.3.8 or later which addresses this vulnerability.
Who is affected by CVE-2023-38271?
CVE-2023-38271 affects users of IBM Cloud Pak System versions 2.3.3.0 to 2.3.3.7, including their respective iFixes.
What kind of information can be exposed by CVE-2023-38271?
CVE-2023-38271 allows an authenticated user to obtain sensitive information from log files, potentially compromising data security.
Is CVE-2023-38271 a remote or local vulnerability?
CVE-2023-38271 is classified as a local vulnerability since it requires authentication to exploit.
- agent/weakness
- agent/title
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/references
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/source
- agent/author
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup-request
- vendor/ibm
- canonical/ibm cloud pak system
- version/ibm cloud pak system/2.3.3.0
- version/ibm cloud pak system/2.3.3.3, 2.3.3.3ifix1
- version/ibm cloud pak system/2.3.3.4
- version/ibm cloud pak system/2.3.3.5
- version/ibm cloud pak system/2.3.3.6, 2.3.3.6 ifix1, 2.3.3.6 ifix2
- canonical/ibm
- version/ibm/version(s) (power)
- version/ibm cloud pak system/2.3.3.7, 2.3.3.7 ifix1