CVE-2023-50962 is a medium severity (CVSS 5.9) flaw in IBM PowerSC 1.3, 2.0 and 2.1, where the MFA component does not implement HTTP Strict Transport Security. IBM recommends updating to PowerSC 2.2, available from IBM Fix Central, and lists no workarounds.
What's affected
IBM's bulletin lists PowerSC 1.3, 2.0 and 2.1 as affected. It names the filesets powerscStd.uiServer, powerscStd.uiAgent and powerscMFA.server, with a lower level of 1.3.0.4 and an upper level of 2.1.0.6.
The recommended fix is PowerSC 2.2 from IBM Fix Central. The bulletin lists no workarounds or mitigations. The record's CWE list repeats CWE-319 twice, which is just a duplicate entry.
CVSS for this entry is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
How to check if you're exposed
PowerSC runs on AIX, so you can list the installed filesets with the standard AIX tool and compare the levels with IBM's range.
lslpp -l powerscStd.uiServer powerscStd.uiAgent powerscMFA.server
Any level from 1.3.0.4 through 2.1.0.6 falls inside the range in the bulletin.
What to do now
- Run the fileset listing above on each PowerSC host and note the levels.
- Plan the update to PowerSC 2.2 from IBM Fix Central.
- After updating, repeat the listing to confirm the new levels.
- Make sure users reach the MFA web interface over HTTPS only, and review where that interface is exposed on your network.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-319 is cleartext transmission of sensitive information. Without transport protections such as HSTS, a browser can be nudged onto plain HTTP, where traffic can be read. The fix is to enforce encrypted transport so the browser refuses to fall back.
HSTS tells a browser to use HTTPS for a site and refuse to downgrade. Without it, a user who types a plain HTTP address, or follows an old link, can be exposed to an attacker who intercepts that first request. The vector reflects this: network access, high attack complexity, and a confidentiality impact.
It is a modest flaw on its own, but it sits on a multi-factor authentication service, so leaked session data there is worth taking seriously.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Does HSTS stop all interception?
No. It makes browsers insist on HTTPS after they have seen the policy. It is one layer, and IBM's fix is to update the product.
What version fixes it?
IBM's bulletin recommends PowerSC 2.2 from Fix Central.
Sources
Last reviewed: 19 October 2026.
