5.3
Moyenne
CVE-2023-38281 IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies
Description
IBM Cloud Pak System does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cloud Pak System 2.3 | 2.3.4.0 → 2.3.6.0 | Pas de correctif indiqué |
| OS Image for Red Hat Linux Systems 5.0 | 5.0.0.0 → 5.0.1.0 | Pas de correctif indiqué |
| OS Image for Red Hat Linux Systems 4.0 | 4.0.4.0 → 4.0.7.0 | Pas de correctif indiqué |
Autres CVE de Cloud Pak System
Les 40 CVE de Cloud Pak System →
CVE-2023-38375
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting
6.1
Moyenne
CVE-2026-3161
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an…
5.9
Moyenne
CVE-2026-3295
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting
7.4
Élevée
CVE-2026-4418
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection
5.4
Moyenne