CVEvulnerability

CVE-2022-38386

5.9 MEDIUM Published 2024-05-01 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-05-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1275

Description

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1.10.12.0 through 1.10.19.0 does not set the SameSite attribute for sensitive cookies which could allow an attacker to obtain sensitive information using man-in-the-middle techniques. IBM X-Force ID: 233778.

Affected configurations

• ibm cloud pak for security (>= 1.10.0.0 <= 1.10.11.0) • ibm qradar suite (>= 1.10.12.0 <= 1.10.19.0)

Related

Weakness · CWE (1)

  • CWE-1275 Sensitive Cookie with Improper SameSite Attribute weakness

References