CVE-2023-38272: ibm cloud pak system Channel Accessible by Non-Endpoint

Vulnerability summary

CVE-2023-38272 is a high (CVSS 7.5) Channel Accessible by Non-Endpoint vulnerability in ibm cloud pak system. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.5% of scored vulnerabilities.

Timeline

1. 27-03-2025
   PublishedVulnerability first disclosed.
2. 17-08-2025
   Last modifiedVulnerability information updated.

Description

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 could allow a user with access to the network to obtain sensitive information from CLI arguments.

• CWE-300Channel Accessible by Non-EndpointThe product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.