CVE-2023-40691

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Business Automation	18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/264805VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7096365Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/264805VDB Entry, Vendor Advisory
https://www.ibm.com/support/pages/node/7096365Patch, Vendor Advisory

Timeline

Published: Dec 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-406927.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress c CVE-2023-406935.4IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.1.0 through 6.2.1.1_CVE-2023-406945.5IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. I CVE-2023-406958.8IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to imperso CVE-2023-406967.5IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt CVE-2023-406997.5IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-F CVE-2023-40708.1Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p CVE-2023-407027.7PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not requi CVE-2023-407037.5Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume CVE-2023-407049.8The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopard CVE-2023-407055.4Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inje CVE-2023-407069.8There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brut