VMware addressed an information disclosure flaw in VMware Tanzu Application Service for VMs and Isolation Segment
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-20864 | VMware Aria Operations for Logs contains a deserialization vulnerability. VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. NVD description · AI analysis pending | 9.8 | 70% |
| — | ||
| CVE-2023-20891 | The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex enco The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs. NVD description · AI analysis pending | 6.5 | <1% |
| — |
Full article313 words · extracted from securityaffairs.com · click to collapse
VMware fixed an information disclosure flaw in VMware Tanzu Application Service for VMs and Isolation Segment that exposed CF API admin credentials in audit logs.
VMware has addressed an information disclosure vulnerability, tracked as CVE-2023-20891 (CVSSv3 score 6.5), in VMware Tanzu Application Service for VMs (TAS for VMs) and Isolation Segment that exposed logged credentials via system audit logs.
VMware Tanzu Application Service for VMs allows organizations to deploy and manage modern applications in a virtualized infrastructure environment.
A remote attacker with low privileges, and who has access to the platform system audit logs, can exploit the vulnerability to access CF API admin credentials in hex encoding.
The company pointed out that in a default installation, non-admin users do not have access to the platform system audit logs.
“The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs.” reads the advisory. “A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application.”
Once obtained the credentials, threat actors can push malicious app versions.
To address the flaw CVE-2023-20891, admins are recommended to install the patches listed in the ‘Fixed Version’ column of the ‘Resolution Matrix’ included in the advisory.
The virtualization giant also recommends all the impacted users of Vmware Tanzu Application Service for VMs and Isolation Segment to do CF API admin credential rotation as per its KB here.
In July, the virtualization giant warned customers of the availability of an exploit code for the critical RCE vulnerability CVE-2023-20864 in the VMware Aria Operations for Logs analysis tool (formerly vRealize Log Insight).
Follow me on Twitter: @securityaffairs Facebook and Mastodon
(SecurityAffairs – hacking, Tanzu Application Service for VMs)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/148793/security/vmware-tanzu-application-service-flaw.html