CVE-2023-38367: IBM Cloud Pak for Automation authentication bypass

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-29 · updated 2026-06-17
Weakness: CWE-287

Description

IBM Cloud Pak Foundational Services Identity Provider (idP) API (IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2) allows CRUD Operations with an invalid token. This could allow an unauthenticated attacker to view, update, delete or create an IdP configuration. IBM X-Force ID: 261130.

Affected products

IBM Cloud Pak for Business Automation: 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3 (+63)

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/261130
https://www.ibm.com/support/pages/node/7015271
https://exchange.xforce.ibmcloud.com/vulnerabilities/261130
https://www.ibm.com/support/pages/node/7015271

Get alerted when CVE-2023-38367 or the next vulnerability affects your stack