---
id: CVE-2023-38375
title: IBM Cloud Pak System Cross-Site Scripting
summary: >-
  IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site
  scripting. This vulnerability allows users to embed arbitrary JavaScript code
  in the Web UI thus altering the intended functionality potentially leading to
  credentials…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: IBM
product: Cloud Pak System
affected:
  - cloud_pak_system 2.3.6.0
  - cloud_pak_system 2.3.6.1
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T17:40:04.905Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-38375'
references:
  - url: 'https://www.ibm.com/support/pages/node/7290183'
tags:
  - cve.org
ingestedAt: '2026-10-19T18:35:50.160Z'
---

## Overview

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

## Affected

- `cloud_pak_system 2.3.6.0`
- `cloud_pak_system 2.3.6.1`

## Remediation

IBM strongly recommends addressing the vulnerability now by  https://www.ibm.com/support/pages/node/7284365 











For unsupported versions the recommendation is  to upgrade to supported version of the product.