CVSS Score of 10 (low)


Published Jul 26, 2023
Updated: Aug 3, 2023
CWE ID 532


CVE-2023-20891 is an information disclosure vulnerability found in the VMware Tanzu Application Service for VMs and Isolation Segment. The vulnerability arises from the logging of credentials in hex encoding in platform system audit logs. If a non-admin user gains access to these logs, they can retrieve hex encoded CF API admin credentials and potentially push malicious versions of an application. However, in a default deployment, non-admin users are not granted access to the platform system audit logs. The vulnerability has a base severity rating of MEDIUM and a base score of 6.5 according to both [email protected] and [email protected].


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-20891 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options