CVE-2023-20881

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-208825.9In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of CVE-2023-208837.5In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for CVE-2023-208846.1VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. An unauthenticated malicious actor may b CVE-2023-208856.5Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notif CVE-2023-208866.1VMware Workspace ONE UEM console contains an open redirect vulnerability. A malicious actor may be able to redirect a victim to an attacke CVE-2023-208879.8Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for CVE-2023-208888.8Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria O CVE-2023-208897.5Aria Operations for Networks contains an information disclosure vulnerability. A malicious actor with network access to VMware Aria Operatio CVE-2023-20898.8A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown CVE-2023-208907.2Aria Operations for Networks contains an arbitrary file write vulnerability. An authenticated malicious actor with administrative access to CVE-2023-208916.5The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of cre CVE-2023-208929.8The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC proto