CVE-2023-20891 - CVE House

Back to Database

Status published Medium CVE-2023-20891

VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability

6.5 CVSS

Vulnerability Description

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-20891

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.vmware.com/security/advisories/VMSA-2023-0016.html

More from VMware

View All →

Spring Framework STOMP CSRF Vulnerability

Spring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment Variables

Username enumeration vulnerability

Header injection vulnerability

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

Affected Vendor

VMware

View all reports →

Affected Software

VMware Tanzu Application Service for VMs, Isolation segment

Vulnerable Versions:

4.0.x, 3.0.x, 2.13.x, 2.11.x

Timeline

Official Publish: July 26th, 2023

Last Modified: October 21st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1555 Credentials from Password Stores

Credential Access

T1078 Valid Accounts

T1562 Impair Defenses

Defense Evasion