VDB
CVE-2023-20881
CVE-2023-20881
PUBLISHED
CVSS 8.100000381469727 HIGH
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
EPSS 0.36% · 27.7th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score
0.36%
27.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cloudfoundry | cf-deployment | 24.7.0 |
| n/a | Cloud Controller API | Cloud Foundry cloud controller API versions between 1.140 and 1.152.0 and loggregator-agent v7+ |
| cloudfoundry | loggregator-agent | 7.0 |
| cloudfoundry | capi-release | 1.140 |
Timeline
- May 19, 2023 CVE Published
- May 20, 2023 EPSS Score
- Jun 26, 2023 EPSS Score
- Aug 2, 2023 EPSS Score
- Sep 7, 2023 EPSS Score
- Oct 14, 2023 EPSS Score
- Nov 20, 2023 EPSS Score
- Dec 27, 2023 EPSS Score
- Feb 1, 2024 EPSS Score
- Mar 9, 2024 EPSS Score
- Apr 15, 2024 EPSS Score
- May 22, 2024 EPSS Score