CVE-2023-20881CWE-295

Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if…

High · published May 19, 2023

CVSS v3.1
8.1
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.9th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2023-05-19T00:00Z
EPSS history
Timeline
  • 19 MAY 00:00Z
    Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if…
    cvelistv5