CVE-2023-38002 is a medium severity (CVSS 5.0) session handling flaw in the IBM Storage Scale GUI, versions 5.1.0.0 through 5.1.9.2. An authenticated user could steal or manipulate an active session to gain access. IBM fixes it in 5.1.9.3 and 5.2.0.0 or later, and lists no workaround, so upgrade.
What's affected
IBM and the NVD record agree on the range. IBM Storage Scale 5.1.0.0 through 5.1.9.2 is affected. IBM says to apply V5.2.0.0 or V5.1.9.3 or later, both available from IBM Fix Central. Its bulletin is titled "IBM Storage Scale GUI may allow user to steal an active session", which tells you the GUI is the component involved.
On severity, the record scores the flaw 5.0 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. The IBM bulletin shows the same base score of 5 but writes the vector as CVSS 3.0 with the same metrics, and points to X-Force entry 260208 for the current temporal score. So the two sources agree on 5.0 and differ only in the CVSS version label.
The weakness is tracked as CWE-384 (session fixation). The record does not flag the CVE in CISA KEV, and neither the record nor the IBM bulletin says it is exploited in the wild. IBM lists "Workarounds and Mitigations: None".
How to check if you're exposed
Find your Storage Scale version on a cluster node. On Linux nodes where the product is installed from packages, you can query the package and the daemon version:
rpm -q gpfs.base
/usr/lpp/mmfs/bin/mmdiag --version
Use the equivalent package command on Debian style systems. The IBM bulletin is the reference, so if your output is unclear, compare the version with the 5.1.0.0 to 5.1.9.2 range it gives. Check every cluster, including test and backup clusters, because the GUI can run on a separate management node.
Then ask who can reach the GUI. The attack needs an authenticated user, so a short list of GUI accounts and a restricted network path both reduce the risk while you schedule the upgrade.
What to do now
- Record the Storage Scale version on every cluster and note which nodes run the GUI.
- Plan the upgrade to 5.1.9.3 or later in the 5.1 stream, or to 5.2.0.0 or later, using the Fix Central links in the IBM bulletin.
- There is no workaround, so until you upgrade, limit who can log in to the GUI and restrict network access to it to administration networks.
- Review GUI accounts and remove ones that are unused, and check active sessions for logins you do not recognise.
- After the upgrade, confirm the new version string and close the finding in your tracker.
Why it matters
CWE-384 is session fixation, a family of flaws in how an application creates, protects or replaces a login session. When a session can be taken over or steered by another logged in user, that person can act with someone else's rights. IBM describes the effect as gaining access to the system by stealing or manipulating an active session.
The score is medium because the attacker must already be authenticated and the conditions are hard to meet (AC:H). That still matters for storage platforms. Shared clusters hold data for many teams, and a lower privileged user moving up to an administrator session is the kind of step that audits care about. Upgrade on your normal maintenance schedule and sooner if many people can log in.
Quick check
Is there a workaround?
No. IBM lists none in the bulletin. The fix is to upgrade to 5.1.9.3 or later, or to 5.2.0.0 or later.
Why do the record and IBM show different vectors?
They show the same metrics. The record labels it CVSS 3.1 and IBM labels it CVSS 3.0, and both give a base score of 5.0.
Sources
- IBM security bulletin for CVE-2023-38002
- IBM X-Force entry 260208 (linked from the record; we read the IBM bulletin, which points to it)
- CVE-2023-38002 on Gold
Last reviewed: 19 October 2026.
