CVE-2023-38372 IBM Watson IoT Platform information disclosure
An attacker with a stolen authentication token can impersonate authorized users on the IBM Watson IoT Platform, leading to unauthorized access and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38372?
CVE-2023-38372 is a medium-severity authentication bypass vulnerability in IBM Watson IoT Platform, published on 29 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthorized attacker who has obtained an IBM Watson IoT Platform 1.0 security authentication token can use it to impersonate an authorized platform user. IBM X-Force ID: 261201.
Weakness: CWE-287
Which versions are affected by CVE-2023-38372?
It affects 1 product.
Products include Ibm Watson Iot Platform.
How do I fix CVE-2023-38372?
No fix has been published for CVE-2023-38372 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-38372 being exploited?
There is no known exploitation of CVE-2023-38372 in the wild and no public exploit code.
Sources
Also known as GHSA-73mf-287p-8r8c.