cvelistv5 - cve-2023-38013

CVE-2023-38013 (GCVE-0-2023-38013)

Vulnerability from cvelistv5 – Published: 2025-01-25 13:55 – Updated: 2025-01-27 17:02

Summary

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/7159533

Impacted products

	Vendor	Product	Version
	IBM	Cloud Pak System	Affected: 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1 cpe:2.3:a:ibm:cloud_pak_system:2.3.3.0:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:ifix1:::::: cpe:2.3:a:ibm:cloud_pak_system:2.3.3.4:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.5:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix1:::::: cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix2:::::: cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:::::::* cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:ifix1::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-38013",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-27T17:02:29.965914Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-27T17:02:47.819Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:ifix1:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix1:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix2:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:ifix1:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Cloud Pak System",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system."
            }
          ],
          "value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-25T13:55:05.494Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "url": "https://www.ibm.com/support/pages/node/7159533"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Cloud Pak System information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2023-38013",
    "datePublished": "2025-01-25T13:55:05.494Z",
    "dateReserved": "2023-07-11T17:33:12.812Z",
    "dateUpdated": "2025-01-27T17:02:47.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-38013\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2025-01-25T14:15:27.977\",\"lastModified\":\"2025-08-13T18:01:11.313\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.\"},{\"lang\":\"es\",\"value\":\"IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan revelar informaci\u00f3n confidencial en respuestas HTTP que podr\u00eda ayudar en futuros ataques contra el tallo sistema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B1369A7-1661-4754-9740-4A189D9611F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"89A3F996-80B7-4845-B15C-D10A39A675BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:ifix1:*:*:*:*:*:*\",\"matchCriteriaId\":\"54D87560-AFF1-4320-9A08-6AB84B7330F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.4:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"94DE4362-6806-48FA-8529-A989540273F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.5:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF6B16C6-8D4F-480E-8BBA-45853735977D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E929D5FD-319D-45FD-85FF-688528762615\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix1:*:*:*:*:*:*\",\"matchCriteriaId\":\"31C15792-C94C-4599-B32A-287A5B7749A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C056670B-C13D-4E6F-AB80-950A09915DB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AB3D285-C45A-4463-80B1-17A9B6086439\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:ifix1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AC8B844-D88C-4029-8395-A73853195EC5\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7159533\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-38013\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-27T17:02:29.965914Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-27T17:02:41.364Z\"}}], \"cna\": {\"title\": \"IBM Cloud Pak System information disclosure\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:ifix1:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.4:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.5:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix1:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix2:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:ifix1:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Cloud Pak System\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7159533\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201 Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2025-01-25T13:55:05.494Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-38013\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-27T17:02:47.819Z\", \"dateReserved\": \"2023-07-11T17:33:12.812Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2025-01-25T13:55:05.494Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-M2FR-34QC-XRJJ

Vulnerability from github – Published: 2025-01-25 15:30 – Updated: 2025-01-25 15:30

Details

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-38013"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-25T14:15:27Z",
    "severity": "MODERATE"
  },
  "details": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.",
  "id": "GHSA-m2fr-34qc-xrjj",
  "modified": "2025-01-25T15:30:31Z",
  "published": "2025-01-25T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38013"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7159533"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CNVD-2025-02817

Vulnerability from cnvd - Published: 2025-02-13

Title

IBM Cloud Pak System信息泄露漏洞（CNVD-2025-02817）

Description

IBM Cloud Pak System是美国国际商业机器（IBM）公司的一套具有可配置、预集成软件的全栈、融合基础架构。该产品支持跨混合云部署、管理和移动应用程序环境。 IBM Cloud Pak System存在信息泄露漏洞，该漏洞源于会在HTTP响应中泄露敏感信息。攻击者可利用该漏洞获取敏感信息。

Severity

中

Patch Name

IBM Cloud Pak System信息泄露漏洞（CNVD-2025-02817）的补丁

Patch Description

IBM Cloud Pak System是美国国际商业机器（IBM）公司的一套具有可配置、预集成软件的全栈、融合基础架构。该产品支持跨混合云部署、管理和移动应用程序环境。 IBM Cloud Pak System存在信息泄露漏洞，该漏洞源于会在HTTP响应中泄露敏感信息。攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7159533

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-38013

Impacted products

Name
['IBM IBM Cloud Pak System 2.3.3.0', 'IBM IBM Cloud Pak System 2.3.3.3', 'IBM IBM Cloud Pak System 2.3.3.3 iFix1', 'IBM IBM Cloud Pak System 2.3.3.4', 'IBM IBM Cloud Pak System 2.3.3.5', 'IBM IBM Cloud Pak System 2.3.3.6', 'IBM IBM Cloud Pak System 2.3.3.6 iFix1', 'IBM IBM Cloud Pak System 2.3.3.6 iFix2', 'IBM IBM Cloud Pak System 2.3.3.7', 'IBM IBM Cloud Pak System 2.3.3.7 iFix1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-38013",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-38013"
    }
  },
  "description": "IBM Cloud Pak System\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u5957\u5177\u6709\u53ef\u914d\u7f6e\u3001\u9884\u96c6\u6210\u8f6f\u4ef6\u7684\u5168\u6808\u3001\u878d\u5408\u57fa\u7840\u67b6\u6784\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u8de8\u6df7\u5408\u4e91\u90e8\u7f72\u3001\u7ba1\u7406\u548c\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u3002\n\nIBM Cloud Pak System\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f1a\u5728HTTP\u54cd\u5e94\u4e2d\u6cc4\u9732\u654f\u611f\u4fe1\u606f\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7159533",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-02817",
  "openTime": "2025-02-13",
  "patchDescription": "IBM Cloud Pak System\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4e00\u5957\u5177\u6709\u53ef\u914d\u7f6e\u3001\u9884\u96c6\u6210\u8f6f\u4ef6\u7684\u5168\u6808\u3001\u878d\u5408\u57fa\u7840\u67b6\u6784\u3002\u8be5\u4ea7\u54c1\u652f\u6301\u8de8\u6df7\u5408\u4e91\u90e8\u7f72\u3001\u7ba1\u7406\u548c\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u3002\r\n\r\nIBM Cloud Pak System\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f1a\u5728HTTP\u54cd\u5e94\u4e2d\u6cc4\u9732\u654f\u611f\u4fe1\u606f\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Cloud Pak System\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-02817\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM IBM Cloud Pak System 2.3.3.0",
      "IBM IBM Cloud Pak System 2.3.3.3",
      "IBM IBM Cloud Pak System 2.3.3.3 iFix1",
      "IBM IBM Cloud Pak System 2.3.3.4",
      "IBM IBM Cloud Pak System 2.3.3.5",
      "IBM IBM Cloud Pak System 2.3.3.6",
      "IBM IBM Cloud Pak System 2.3.3.6 iFix1",
      "IBM IBM Cloud Pak System 2.3.3.6 iFix2",
      "IBM IBM Cloud Pak System 2.3.3.7",
      "IBM IBM Cloud Pak System 2.3.3.7 iFix1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-38013",
  "serverity": "\u4e2d",
  "submitTime": "2025-02-06",
  "title": "IBM Cloud Pak System\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2025-02817\uff09"
}

FKIE_CVE-2023-38013

Vulnerability from fkie_nvd - Published: 2025-01-25 14:15 - Updated: 2025-08-13 18:01

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7159533	Vendor Advisory

Impacted products

Vendor	Product	Version
ibm	cloud_pak_system	2.3.3.0
ibm	cloud_pak_system	2.3.3.3
ibm	cloud_pak_system	2.3.3.3
ibm	cloud_pak_system	2.3.3.4
ibm	cloud_pak_system	2.3.3.5
ibm	cloud_pak_system	2.3.3.6
ibm	cloud_pak_system	2.3.3.6
ibm	cloud_pak_system	2.3.3.6
ibm	cloud_pak_system	2.3.3.7
ibm	cloud_pak_system	2.3.3.7

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5B1369A7-1661-4754-9740-4A189D9611F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "89A3F996-80B7-4845-B15C-D10A39A675BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.3:ifix1:*:*:*:*:*:*",
              "matchCriteriaId": "54D87560-AFF1-4320-9A08-6AB84B7330F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "94DE4362-6806-48FA-8529-A989540273F2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.5:-:*:*:*:*:*:*",
              "matchCriteriaId": "DF6B16C6-8D4F-480E-8BBA-45853735977D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:-:*:*:*:*:*:*",
              "matchCriteriaId": "E929D5FD-319D-45FD-85FF-688528762615",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix1:*:*:*:*:*:*",
              "matchCriteriaId": "31C15792-C94C-4599-B32A-287A5B7749A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.6:ifix2:*:*:*:*:*:*",
              "matchCriteriaId": "C056670B-C13D-4E6F-AB80-950A09915DB3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:-:*:*:*:*:*:*",
              "matchCriteriaId": "6AB3D285-C45A-4463-80B1-17A9B6086439",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:cloud_pak_system:2.3.3.7:ifix1:*:*:*:*:*:*",
              "matchCriteriaId": "1AC8B844-D88C-4029-8395-A73853195EC5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system."
    },
    {
      "lang": "es",
      "value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan revelar informaci\u00f3n confidencial en respuestas HTTP que podr\u00eda ayudar en futuros ataques contra el tallo sistema."
    }
  ],
  "id": "CVE-2023-38013",
  "lastModified": "2025-08-13T18:01:11.313",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-01-25T14:15:27.977",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7159533"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2023-38013

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2023-38013

Aliases

CVE-2023-38013

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-38013",
    "id": "GSD-2023-38013"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-38013"
      ],
      "id": "GSD-2023-38013",
      "modified": "2023-12-13T01:20:35.830736Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-38013",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-38013 (GCVE-0-2023-38013)

GHSA-M2FR-34QC-XRJJ

CNVD-2025-02817

FKIE_CVE-2023-38013

GSD-2023-38013

Tags

Sightings

Nomenclature