CVE-2022-38386

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1275

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Security	>= 1.10.0.0, <= 1.10.11.0
IBM	QRadar Suite for Software	>= 1.10.12.0, <= 1.10.19.0
ibm	cloud_pak_for_security	>= 1.10.0.0, <= 1.10.11.0
ibm	qradar_suite	>= 1.10.12.0, <= 1.10.19.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/233778Vendor Advisory
https://www.ibm.com/support/pages/node/7149811Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/233778Vendor Advisory
https://www.ibm.com/support/pages/node/7149811Vendor Advisory

Timeline

Published: May 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-383878.8IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the CVE-2022-383885.5IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to improper access control CVE-2022-383899.1IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A CVE-2022-38394.8The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2022-383905.4Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar CVE-2022-383917.5IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informa CVE-2022-383925.3Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a den CVE-2022-383937.5A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 rout CVE-2022-383949.8Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthentica CVE-2022-383957.8HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It CVE-2022-383967.8HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation CVE-2022-383985.3Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. Thi