« Volver al listado

CVE-2023-20885

Estado: ModificadaMedia (6.5)—

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Pivotal — Cloud Foundry NFS VolumePivotal — Cloud Foundry NotificationsPivotal — Cloud Foundry SMB Volume

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-20885",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-20885",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-16T20:04:33.907955Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "Cloud Foundry",
          "product": " Notifications",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 63"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Cloud Foundry",
          "product": "SMB-volume release",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 3.1.19"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Cloud FOundry",
          "product": "cf-nfs-volume release",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.x versions prior to 5.0.27"
            },
            {
              "status": "affected",
              "version": "7.1.x versions prior to 7.1.19"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-06-16T13:15:09.463",
  "references": [
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    },
    {
      "url": "https://www.cloudfoundry.org/blog/cve-2023-20885-cf-workflows-leak-credentials-in-system-audit-logs/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions prior to 7.1.19.\n\n"
    }
  ],
  "lastModified": "2026-06-17T05:31:06.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal:cloud_foundry_nfs_volume:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "708A44E3-874B-4A4F-9B91-432E7D4131BB",
              "versionEndExcluding": "5.0.27",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:cloud_foundry_nfs_volume:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4887C1A5-6FD4-49C3-A33E-01BD57C785F5",
              "versionEndExcluding": "7.1.19",
              "versionStartIncluding": "7.1.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:cloud_foundry_notifications:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17581E39-7468-41C0-A0F3-8247B35F36C9",
              "versionEndExcluding": "63"
            },
            {
              "criteria": "cpe:2.3:a:pivotal:cloud_foundry_smb_volume:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14458EC9-C02D-4DB8-A93E-87C1057F0AA8",
              "versionEndExcluding": "3.1.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}