CVE-2023-38375 in Cloud Pak System
Summary
by MITRE • 10/19/2026
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw resides within IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1, specifically affecting its web-based user interface components. This vulnerability is classified as an instance of Cross-Site Scripting, commonly referred to by the industry standard identifier CWE-79. The core technical issue stems from insufficient validation or sanitization of user-supplied input before it is processed and rendered by the application's front-end logic. When a malicious actor constructs a specially crafted request containing embedded JavaScript code, the system fails to properly escape this content. Consequently, when other users interact with the affected interface elements that display this unvalidated data, the browser executes the injected script within the context of the trusted domain hosting IBM Cloud Pak System.
From an operational perspective, the impact of this vulnerability is significant because it allows for session hijacking and unauthorized access to sensitive system resources. By executing arbitrary JavaScript in the victim's browser, an attacker can bypass same-origin policy restrictions that typically protect web applications from malicious scripts running on other domains. This capability enables the extraction of critical authentication artifacts such as session cookies or tokens stored by the browser. If these credentials are intercepted, the attacker gains the ability to impersonate legitimate users who have active sessions with IBM Cloud Pak System. This leads directly to a compromise of confidentiality and potentially integrity, as the attacker can perform actions on behalf of the victim within their trusted session context without requiring further authentication steps.
The attack vector for this vulnerability typically involves social engineering or direct manipulation of web application inputs where user data is reflected back into the page without adequate encoding. An adversary might craft a malicious link containing script payloads in query parameters or form fields, which triggers the execution when viewed by an administrator or privileged user within the IBM Cloud Pak System environment. This aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection and Credential Access via Browser Session Hijacking. The persistence of this risk is heightened if session tokens are not adequately protected against theft through secure cookie flags such as HttpOnly, although relying solely on server-side protections does not mitigate the fundamental flaw in input handling.
To mitigate this vulnerability, immediate patching to a version of IBM Cloud Pak System that includes the security fix for CVE-2021-45968 is required. In addition to applying vendor-provided updates, administrators should implement robust input validation strategies on both client and server sides. This involves enforcing strict allow-lists for acceptable characters in all user inputs and ensuring that any data rendered back into HTML contexts is properly encoded using appropriate escaping mechanisms such as HTML entity encoding or JavaScript string escaping. Furthermore, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking requests containing known malicious script patterns before they reach the application logic. Regular security audits and penetration testing focused on injection flaws are also recommended to identify similar weaknesses across other components of the infrastructure.