Information disclosure in VMware Tanzu Application Service for VMs and Isolation Segment

1) Information disclosure

EUVDB-ID: #VU78668

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-20891

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the logging of credentials in hex encoding in platform system audit logs. A remote user can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

VMware Tanzu Application Service for VMs: 2.11.0 - 4.0.4

Isolation Segment: 2.11.0 - 4.0.3

CPE2.3

• cpe:2.3:a:vmware:vmware_tanzu_application_service_for_vms:2.11.41:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:vmware_tanzu_application_service_for_vms:2.13.23:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:vmware_tanzu_application_service_for_vms:3.0.13:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:vmware_tanzu_application_service_for_vms:4.0.4:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:isolation_segment:2.11.34:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:isolation_segment:2.13.19:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:isolation_segment:3.0.12:*:*:*:*:*:*:*
• cpe:2.3:a:vmware:isolation_segment:4.0.3:*:*:*:*:*:*:*

External links

http://www.vmware.com/security/advisories/VMSA-2023-0016.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.