PT-2022-6764 · Vmware · Vmware Tanzu Application Service For Vms+1

Published 2022-11-01 · Updated 2023-08-03 · CVE-2023-20891

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Tanzu Application Service for VMs and Isolation Segment (affected versions not specified)

Description The issue is related to an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment, non-admin users do not have access to the platform system audit logs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-04285

CVE-2023-20891

Affected Products

Isolation Segment

Vmware Tanzu Application Service For Vms

References · 9

• https://osv.dev/vulnerability/CVE-2023-20891 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2023-0016.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04285 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20891 · Security Note
• https://t.me/cibsecurity/67295 · Telegram Post
• https://vuldb.com/ru/?id.235417 · Note
• https://docs.vmware.com/en/VMware-Tanzu-Application-Service/4.0/tas-for-vms/api-endpoint.html · Note
• https://securityaffairs.com/148793/security/vmware-tanzu-application-service-flaw.html · Note
• https://t.me/cvenotify/55163 · Telegram Post