CVE-2023-38363

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM CICS TX Advanced 10.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 260818.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
IBM	CICS TX Advanced	10.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/260818VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7067987Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/260818VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7067987Patch, Vendor Advisory

Timeline

Published: Nov 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-383646.1IBM CICS TX Advanced 10.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W CVE-2023-383665.3IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. A CVE-2023-383676.5IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3 CVE-2023-383685.5IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission CVE-2023-383697.5IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default,CVE-2023-38374.8A vulnerability classified as problematic has been found in DedeBIZ 6.2.10. Affected is an unknown function of the file /admin/sys_sql_query CVE-2023-383706.5IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install mal CVE-2023-383717.5IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker CVE-2023-383727.5An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authoriz CVE-2023-383756.1IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri CVE-2023-383789.8The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code v CVE-2023-383797.5The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin passwor