{"id":"CVE-2022-38382","aliases":["EUVD-2022-40968","GHSA-r67g-69pq-w76x"],"status":"published","title":"IBM Cloud Pak for Security session fixation","description":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information.  IBM X-Force ID:  233672.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00302,"percentile":0.23159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2024-08-13T01:01:33Z","modified":"2026-06-17T04:56:30Z","products":[{"vendor":"ibm","product":"cloud pak for security"},{"vendor":"ibm","product":"cloud_pak_for_security"},{"vendor":"ibm","product":"qradar suite software"},{"vendor":"ibm","product":"qradar_suite"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7165286","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/233672","tags":["vdb-entry","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38382"},{"url":"https://github.com/advisories/GHSA-r67g-69pq-w76x"}],"sources":{"cve":[{"id":"CVE-2022-38382","title":"IBM Cloud Pak for Security session fixation","description":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information.  IBM X-Force ID:  233672.","status":"published","published":"2024-08-13T01:01:33.992Z","modified":"2024-09-21T09:50:16.866Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-40968","description":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information.  IBM X-Force ID:  233672.","status":"published","published":"2024-08-13T01:01:33Z","modified":"2024-09-21T09:50:16Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:17.441522Z"}],"ghsa":[{"id":"GHSA-r67g-69pq-w76x","title":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10...","description":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information.  IBM X-Force ID:  233672.","status":"published","published":"2024-08-13T03:31:16Z","modified":"2024-08-13T03:31:22Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:57:56.424434Z"}],"nvd":[{"id":"CVE-2022-38382","description":"IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another authenticated user to obtain sensitive information.  IBM X-Force ID:  233672.","status":"published","published":"2024-08-13T02:15:04.73Z","modified":"2026-06-17T04:56:30.147Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:07:40.49892Z"}]}}