CVE-2022-38382

2024-08-1302:15:04

CWE-613

[email protected]

web.nvd.nist.gov

ibm

cp4s

qradar suite

session

invalidation

sensitive information

x-force id

CVSS3

4.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

EPSS

Percentile

13.8%

JSON

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information. IBM X-Force ID: 233672.

Affected configurations

Nvd

Node

ibmcloud_pak_for_securityRange1.10.0.0–1.10.11.0

ibmqradar_suiteRange1.10.12.0–1.10.23.0

VendorProductVersionCPE
ibmcloud_pak_for_security*cpe:2.3:a:ibm:cloud_pak_for_security:*:*:*:*:*:*:*:*
ibmqradar_suite*cpe:2.3:a:ibm:qradar_suite:*:*:*:*:*:*:*:*