PT-2023-13052 · Unknown · Diego-Release+1

Maximilian Moehl · Publicado 2023-02-03 · Atualizado 2025-03-25 · CVE-2022-31733

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions diego-release versions 2.55.0 through 2.69.0 CF Deployment versions 17.1 through 23.2.0

Description The issue allows applications to be accessible via another port on diego cells, enabling application ingress without a client certificate. If mTLS route integrity is enabled and unproxied ports are turned off, an attacker could connect to an application that should only be reachable via mTLS without presenting a client certificate.

Recommendations For diego-release versions 2.55.0 through 2.69.0, consider disabling the unproxied ports to minimize the risk of exploitation. For CF Deployment versions 17.1 through 23.2.0, ensure that mTLS route integrity is disabled or properly configured to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2022-31733

Produtos afetados

Cf-Deployment

Diego-Release

Referências · 5

• https://t.me/cvenotify/116219 · Publicação no Telegram
• https://t.me/cibsecurity/57500 · Publicação no Telegram
• https://cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-31733 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-31733 · Aviso do Fabricante