CVE-2023-38007

MEDIUM

IBM Cloud Pak System 2.3.3.6-2.3.5.0 - Cross-Site Scripting

Title source: llm
STIX 2.1

Description

IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7237162

Scores

CVSS v3 5.4
EPSS 0.0009
EPSS Percentile 25.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-80 CWE-79
Status published
Products (5)
ibm/cloud_pak_system 2.3.3.6 (3 CPE variants)
ibm/cloud_pak_system 2.3.3.7 (2 CPE variants)
ibm/cloud_pak_system 2.3.4.0
ibm/cloud_pak_system 2.3.4.1
ibm/cloud_pak_system 2.3.5.0
Published Jun 27, 2025
Tracked Since Feb 18, 2026