CVE-2023-38363: IBM CICS TX information disclosure

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/260818
• https://www.ibm.com/support/pages/node/7067987 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7067987

Frequently Asked Questions

• What is the vulnerability ID for IBM CICS TX information disclosure?

  The vulnerability ID for IBM CICS TX information disclosure is CVE-2023-38363.

• What is the severity of CVE-2023-38363?

  The severity of CVE-2023-38363 is medium with a CVSS score of 4.3.

• How does IBM CICS TX Advanced handle authorization tokens and session cookies?

  IBM CICS TX Advanced does not set the secure attribute on authorization tokens or session cookies.

• How can attackers exploit the vulnerability in IBM CICS TX Advanced?

  Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to.

• Is there a patch available for IBM CICS TX Advanced?

  Yes, a patch is available for IBM CICS TX Advanced. You can download it from the following URL: [IBM CICS TX Advanced Patch](https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FCICS+TX+on+Cloud&fixids=ibm-cics-tx-advanced-docker-image-10.1.0.0-ifix22&source=SAR)