CVE Vulnerabilities

CVE-2023-38271

Insertion of Sensitive Information into Log File

Published: Jan 25, 2025 | Modified: Aug 13, 2025
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
root.io logo minimus.io logo echo.ai logo

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.

Weakness

The product writes sensitive information to a log file.

Affected Software

NameVendorStart VersionEnd Version
Cloud_pak_systemIbm2.3.3.0 (including)2.3.3.0 (including)
Cloud_pak_systemIbm2.3.3.3 (including)2.3.3.3 (including)
Cloud_pak_systemIbm2.3.3.3-ifix1 (including)2.3.3.3-ifix1 (including)
Cloud_pak_systemIbm2.3.3.4 (including)2.3.3.4 (including)
Cloud_pak_systemIbm2.3.3.5 (including)2.3.3.5 (including)
Cloud_pak_systemIbm2.3.3.6 (including)2.3.3.6 (including)
Cloud_pak_systemIbm2.3.3.6-ifix1 (including)2.3.3.6-ifix1 (including)
Cloud_pak_systemIbm2.3.3.6-ifix2 (including)2.3.3.6-ifix2 (including)
Cloud_pak_systemIbm2.3.3.7 (including)2.3.3.7 (including)
Cloud_pak_systemIbm2.3.3.7-ifix1 (including)2.3.3.7-ifix1 (including)

Potential Mitigations

References