CVE-2023-20881

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-19 · updated 2026-06-17
Weakness: CWE-295

Description

Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.

Affected products

Cloud Foundry CAPI: from 1.140 through 1.152.0
Cloud Foundry cf-deployment: from 24.7.0 through 29.0.0
Cloudfoundry Loggregator-Agent: from 7.0 through 7.2.1

References

https://www.cloudfoundry.org/blog/cve-2023-20881-cas-for-syslog-drain-mtls-feature-can-be-overwritten/
https://www.cloudfoundry.org/blog/cve-2023-20881-cas-for-syslog-drain-mtls-feature-can-be-overwritten/

Get alerted when CVE-2023-20881 or the next vulnerability affects your stack