What is CVE-2022-31733?

CVE-2022-31733 is a critical-severity vulnerability in Cloudfoundry Cf-deployment, classified under Improper Certificate Validation. CVSS score: 9.1/10. Published 2023-02-03.

How severe is CVE-2022-31733?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Cloudfoundry Cf-deployment

CVE-2022-31733

Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integ…

Vulnerability class: Improper Certificate Validation

EPSS: 0.004 (30.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Cloudfoundry Cf-deployment
Cloudfoundry Diego
N/a Cloud Foundry Diego And Cf Deployment — versions Affected versions of Diego are all versions between 2.55.0 and 2.69.0 (inclusive) and affected versions of CF Deployment are all versions between 17.1 and 23.2.0 (inclusive).

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

security@vmware.com (Vendor Advisory)

Frequently asked questions

What is CVE-2022-31733?: CVE-2022-31733 is a critical-severity vulnerability in Cloudfoundry Cf-deployment, classified under Improper Certificate Validation. CVSS score: 9.1/10. Published 2023-02-03.
How severe is CVE-2022-31733?: Critical severity. CVSS v3 base score is 9.1 out of 10.