CVE-2023-38013
Published: 25 January 2025
Summary
CVE-2023-38013 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Ibm Cloud Pak System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2023-38013 affects IBM Cloud Pak System versions 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1. The vulnerability involves the disclosure of sensitive information in HTTP responses, classified under CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor), with additional NVD-CWE-noinfo notation. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity primarily due to confidentiality impact.
Attackers with network access can exploit this vulnerability without authentication, privileges, or user interaction, requiring only low attack complexity. Exploitation discloses sensitive information in HTTP responses, enabling low-impact confidentiality breaches that could facilitate further attacks against the system.
IBM's security advisory at https://www.ibm.com/support/pages/node/7159533 details the issue and provides guidance on mitigations or patches for the affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-41840
Vulnerability details
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct info disclosure via unauthenticated HTTP responses on a public-facing IBM Cloud Pak System instance enables exploitation of the public application for reconnaissance.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the flaw causing sensitive information disclosure in HTTP responses through identification, reporting, and correction of vulnerabilities in affected IBM Cloud Pak System versions.
Filters sensitive information content from HTTP responses before sharing with non-privileged or unauthorized network actors.
Restricts and controls sensitive information posted or accessible via the system's publicly facing HTTP interfaces.