PT-2023-13052 · Unknown · Diego-Release+1

Maximilian Moehl · Published 2023-02-03 · Updated 2025-03-25 · CVE-2022-31733

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions diego-release versions 2.55.0 through 2.69.0 CF Deployment versions 17.1 through 23.2.0

Description The issue allows applications to be accessible via another port on diego cells, enabling application ingress without a client certificate. If mTLS route integrity is enabled and unproxied ports are turned off, an attacker could connect to an application that should only be reachable via mTLS without presenting a client certificate.

Recommendations For diego-release versions 2.55.0 through 2.69.0, consider disabling the unproxied ports to minimize the risk of exploitation. For CF Deployment versions 17.1 through 23.2.0, ensure that mTLS route integrity is disabled or properly configured to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-31733

Affected Products

Cf-Deployment

Diego-Release

References · 5

• https://cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31733 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31733 · Vendor Advisory
• https://t.me/cvenotify/116219 · Telegram Post
• https://t.me/cibsecurity/57500 · Telegram Post