Strix
26.1K

CVE-2023-20891

MEDIUMCVSS 6.5/10EPSS 0.53%

Last modified

CVE-2023-20891 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.. EPSS estimates a 0.53% chance of exploitation in the next 30 days.

Description

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.53%

40.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
VmwareIsolation Segment>= 2.11.0, < 2.11.35
VmwareIsolation Segment>= 2.13.0, < 2.13.20
VmwareIsolation Segment>= 3.0.0, < 3.0.13
VmwareIsolation Segment>= 4.0.0, < 4.0.4
VmwareTanzu Application Service For Virtual Machines>= 2.11.0, < 2.11.42
VmwareTanzu Application Service For Virtual Machines>= 2.13.0, < 2.13.24
VmwareTanzu Application Service For Virtual Machines>= 3.0.0, < 3.0.14
VmwareTanzu Application Service For Virtual Machines>= 4.0.0, < 4.0.5

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-20891?
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
How severe is CVE-2023-20891?
CVE-2023-20891 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 0.53% probability of exploitation in the next 30 days.
How do I fix CVE-2023-20891?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-20891?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST