CVE-2023-38375: IBM Cloud Pak System XSS Vulnerability

CVE-2023-38375 Overview

CVE-2023-38375 is a reflected cross-site scripting (XSS) vulnerability affecting IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1. The flaw allows attackers to embed arbitrary JavaScript code within the Web UI, altering intended functionality and potentially exposing credentials within a trusted session. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). IBM published remediation guidance in its IBM Support Documentation.

Critical Impact
Attackers can inject JavaScript into the Cloud Pak System Web UI, leading to credential theft and session manipulation when administrators interact with crafted content.

Affected Products

IBM Cloud Pak System 2.3.6.0
IBM Cloud Pak System 2.3.6.1
IBM Cloud Pak System Web UI component

Discovery Timeline

2026-10-19 - CVE-2023-38375 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2023-38375

Vulnerability Analysis

CVE-2023-38375 is a cross-site scripting weakness in the IBM Cloud Pak System Web UI. The application accepts user-supplied input and renders it into web responses without adequate neutralization. An attacker who convinces an authenticated user to click a crafted link can execute arbitrary JavaScript in the victim's browser context.

Execution occurs within the trust boundary of the Cloud Pak System session. The injected script can read Document Object Model (DOM) content, exfiltrate session cookies, capture keystrokes from login forms, or submit requests on behalf of the victim. User interaction is required, limiting mass exploitation but not targeted attacks against administrators.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Web UI fails to encode or sanitize attacker-controlled strings before reflecting them into HTML responses. Standard output encoding and Content Security Policy (CSP) controls were insufficient to block script execution in the affected versions.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts a malicious URL or payload containing JavaScript and delivers it through phishing, chat, or an attacker-controlled page. When an authenticated Cloud Pak System user loads the payload in a browser session with the Web UI, the script executes. The scope change in the scoring reflects that impact extends beyond the vulnerable component to the user's trusted session, enabling credential disclosure and unauthorized actions.

Detection Methods for CVE-2023-38375

Indicators of Compromise

Web UI access logs containing <script>, javascript:, onerror=, or onload= tokens in query strings or form parameters.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after Cloud Pak System Web UI sessions.
Session cookies or authentication tokens appearing in referrer headers or external request bodies.
Unexpected administrative changes performed from legitimate user accounts without corresponding console activity.

Detection Strategies

Deploy a web application firewall (WAF) with signatures for reflected XSS payloads targeting the Cloud Pak System Web UI paths.
Correlate Web UI request logs with browser telemetry to identify script execution originating from server-reflected content.
Hunt for anomalous JavaScript event handlers or encoded payloads in HTTP parameters logged by reverse proxies.

Monitoring Recommendations

Enable verbose HTTP access logging on the Cloud Pak System management interface and forward logs to a central analytics platform.
Monitor administrator user agents, source IP addresses, and session durations for deviations from baseline behavior.
Alert on repeated 4xx responses containing script-like payloads, which often indicate exploitation attempts.

How to Mitigate CVE-2023-38375

Immediate Actions Required

Apply the fix referenced in the IBM Support Documentation for Cloud Pak System 2.3.6.0 and 2.3.6.1.
Restrict Web UI access to trusted management networks and administrator jump hosts.
Instruct administrators to avoid clicking Cloud Pak System links received through email, chat, or external sites until patching is complete.

Patch Information

IBM has published a security bulletin and remediation instructions for CVE-2023-38375. Review the IBM Support Documentation for the applicable interim fix or upgrade package for Cloud Pak System 2.3.6.0 and 2.3.6.1 and schedule deployment under change control.

Workarounds

Enforce a strict Content Security Policy (CSP) at the reverse proxy to block inline script execution within the Web UI.
Require administrators to use dedicated browser profiles or privileged access workstations for Cloud Pak System management.
Terminate idle Web UI sessions aggressively and require re-authentication for sensitive administrative actions.

bash

# Example reverse proxy header hardening for the Cloud Pak System Web UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;