VDB
CVE-2023-20881
CVE-2023-20881
PUBLISHED
CVSS 8.100000381469727 HIGH
Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.
EPSS 0.36% · 29.0th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score
0.36%
29.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cloudfoundry | cf-deployment | 24.7.0 |
| n/a | Cloud Controller API | Cloud Foundry cloud controller API versions between 1.140 and 1.152.0 and loggregator-agent v7+ |
| cloudfoundry | loggregator-agent | 7.0 |
| cloudfoundry | capi-release | 1.140 |
Timeline
- May 19, 2023 CVE Published
- May 20, 2023 EPSS Score
- Jun 25, 2023 EPSS Score
- Aug 1, 2023 EPSS Score
- Sep 6, 2023 EPSS Score
- Oct 13, 2023 EPSS Score
- Nov 18, 2023 EPSS Score
- Dec 25, 2023 EPSS Score
- Jan 30, 2024 EPSS Score
- Mar 7, 2024 EPSS Score
- Apr 12, 2024 EPSS Score
- May 18, 2024 EPSS Score