CVE-2023-23469
Ibm Cloud Pak For Business Automation 18.0.0 – 20.0.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2023-23469 is a medium-severity Use of Web Browser Cache Containing Sensitive Information (CWE-525) vulnerability in Ibm Cloud Pak For Business Automation. Its CVSS base score is 4.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27569
Vulnerability Data
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force…
more
ID: 244504.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V14.2.5V14.3.2
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Endpoint device configuration can enforce cache-clearing or no-cache policies for sensitive web content.
Application security requirements can explicitly require no-cache headers or cache-control directives for sensitive pages.
Secure coding standards can mandate proper cache-control headers and form-field handling to prevent sensitive data retention.
Configuration management can mandate secure browser cache settings across the estate.
Web filtering can block risky sites but does not directly govern browser caching of sensitive data.