Description
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-10-19
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting leading to credential disclosure
Action: Patch Now
AI Analysis

Impact

IBM Cloud Pak System version 2.3.6.0 and 2.3.6.1 contain a cross‑site scripting flaw that lets an attacker embed arbitrary JavaScript into the web interface. The injected script can modify the interface and may steal user credentials from a trusted session. This flaw falls under CWE‑79 and can lead to confidentiality loss for credential data within the application context.

Affected Systems

Systems affected by this vulnerability are IBM Cloud Pak System releases 2.3.6.0 and 2.3.6.1. The advisory lists these two specific versions, and they are the only variants identified as vulnerable by IBM.

Risk and Exploitability

The CVSS score of 6.1 indicates medium severity. Because the exploit requires interaction with the web UI, an attacker must be able to influence user input or compromise a logged‑in user. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower chance of mass exploitation, but the potential for credential theft remains. The risk for environments that expose the UI to untrusted users is moderate and warrants timely mitigation.

Generated by OpenCVE AI on October 19, 2026 at 18:20 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by https://www.ibm.com/support/pages/node/7284365 For unsupported versions the recommendation is  to upgrade to supported version of the product.

OpenCVE Recommended Actions

  • Apply the IBM security update referenced in the advisory, which addresses the XSS vulnerability (see https://www.ibm.com/support/pages/node/7284365).
  • If you are running an unsupported version, upgrade to a supported release of IBM Cloud Pak System.
  • Limit access to the web interface to trusted administrators only, and consider enabling a web application firewall or applying input sanitization to reduce the risk of script injection.

Generated by OpenCVE AI on October 19, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title IBM Cloud Pak System Cross-Site Scripting
First Time appeared Ibm
Ibm cloud Pak System
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:cloud_pak_system:2.3.6.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cloud_pak_system:2.3.6.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cloud Pak System
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Cloud Pak System
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-19T17:40:04.905Z

Reserved: 2023-07-16T00:53:28.841Z

Link: CVE-2023-38375

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T18:16:57.533

Modified: 2026-10-19T18:16:57.533

Link: CVE-2023-38375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T18:30:02Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')