Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-20891

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.

Published

2023-07-26T06:15:10.637

Last Modified

2024-11-21T07:41:45.863

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-532
  • Type: Primary
    CWE-532
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vmware isolation_segment < 2.11.35 Yes
Application vmware isolation_segment < 2.13.20 Yes
Application vmware isolation_segment < 3.0.13 Yes
Application vmware isolation_segment < 4.0.4 Yes
Application vmware tanzu_application_service_for_virtual_machines < 2.11.42 Yes
Application vmware tanzu_application_service_for_virtual_machines < 2.13.24 Yes
Application vmware tanzu_application_service_for_virtual_machines < 3.0.14 Yes
Application vmware tanzu_application_service_for_virtual_machines < 4.0.5 Yes
References