CVE-2023-38013
Published: 25 January 2025
Summary
CVE-2023-38013 is a medium-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Ibm Cloud Pak System. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the flaw causing sensitive information disclosure in HTTP responses through identification, reporting, and correction of vulnerabilities in affected IBM Cloud Pak System versions.
Filters sensitive information content from HTTP responses before sharing with non-privileged or unauthorized network actors.
Restricts and controls sensitive information posted or accessible via the system's publicly facing HTTP interfaces.
NVD Description
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.
Deeper analysisAI
CVE-2023-38013 affects IBM Cloud Pak System versions 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1. The vulnerability involves the disclosure of sensitive information in HTTP responses, classified under CWE-201 (Exposure of Sensitive Information to an Unauthorized Actor), with additional NVD-CWE-noinfo notation. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity primarily due to confidentiality impact.
Attackers with network access can exploit this vulnerability without authentication, privileges, or user interaction, requiring only low attack complexity. Exploitation discloses sensitive information in HTTP responses, enabling low-impact confidentiality breaches that could facilitate further attacks against the system.
IBM's security advisory at https://www.ibm.com/support/pages/node/7159533 details the issue and provides guidance on mitigations or patches for the affected versions.
Details
- CWE(s)