What’s Vulnerable › Vulnerabilities

CVE-2023-20891: VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-26 · updated 2026-06-17
• Weakness: CWE-532

Description

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.

Affected products

• VMware Isolation segment: from 2.11.0 before 2.11.35; from 2.13.0 before 2.13.20; from 3.0.0 before 3.0.13; from 4.0.0 before 4.0.4 — fixed in 2.11.35, 2.13.20, 3.0.13, 4.0.4
• VMware Tanzu Application Service For Virtual Machines: from 2.11.0 before 2.11.42; from 2.13.0 before 2.13.24; from 3.0.0 before 3.0.14; from 4.0.0 before 4.0.5 — fixed in 2.11.42, 2.13.24, 3.0.14, 4.0.5
• VMware Isolation segment: from 4.0.x before 4.0.4; from 3.0.x before 3.0.13; from 2.13.x before 2.13.20; from 2.11.x before 2.11.35 — fixed in 4.0.4, 3.0.13, 2.13.20, 2.11.35
• Pivotal VMware Tanzu Application Service for VMs: from 4.0.x before 4.0.5; from 3.0.x before 3.0.14; from 2.13.x before 2.13.24; from 2.11.x before 2.11.42 — fixed in 4.0.5, 3.0.14, 2.13.24, 2.11.42

How to fix

Upgrade to a fixed version: VMware Isolation segment 2.11.35, 2.13.20, 3.0.13, 4.0.4; VMware Tanzu Application Service For Virtual Machines 2.11.42, 2.13.24, 3.0.14, 4.0.5; VMware Isolation segment 4.0.4, 3.0.13, 2.13.20, 2.11.35; Pivotal VMware Tanzu Application Service for VMs 4.0.5, 3.0.14, 2.13.24, 2.11.42. Check the vendor advisory for mitigations.

References

• https://www.vmware.com/security/advisories/VMSA-2023-0016.html
• https://www.vmware.com/security/advisories/VMSA-2023-0016.html

Get alerted when CVE-2023-20891 or the next vulnerability affects your stack