TI-2022-13629 Aliases CVE-2022-31733 GHSA-cxh3-vwqp-fxrv

Improper certificate validation in Cloud Foundry Diego and CF Deployment

MEDIUM 45CWE-295Published 2023-02-03 · Updated 2025-03-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-295.

Summary

Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00378 31st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Cloud Foundry Diego and CF Deployment	Affected versions of Diego are all versions between 2.55.0 and 2.69.0 (inclusive) and affected versions of CF Deployment are all versions between 17.1 and 23.2.0 (inclusive).	—	No fix listed	CNA

Cloud Foundry Diego and CF Deployment Vendor— Affected Affected versions of Diego are all versions between 2.55.0 and 2.69.0 (inclusive) and affected versions of CF Deployment are all versions between 17.1 and 23.2.0 (inclusive). Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cloudfoundry:cf-deployment::::::::	17.1 – 23.2.0	Vulnerable	CloudFoundry Foundation
cpe:2.3:a:cloudfoundry:diego::::::::	2.55.0 – 2.69.0	Vulnerable	CloudFoundry Foundation

cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:* Versions 17.1 – 23.2.0 Vulnerable ·CloudFoundry Foundation
cpe:2.3:a:cloudfoundry:diego:*:*:*:*:*:*:*:* Versions 2.55.0 – 2.69.0 Vulnerable ·CloudFoundry Foundation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-31733
2026-10-03 Alias added: GHSA-cxh3-vwqp-fxrv

References

Advisory 1

https://www.cloudfoundry.org/blog/cve-2022-31733-unsecured-application-port

TI-2019-02813 Java Projects using HTTP to fetch dependencies CVSS 3.1CRITICAL 9.8
TI-2019-08441 Password leak in smbdriver logs CVSS 3.1HIGH 8.8
TI-2020-04463 Cloud Controller may allow developers to claim sensitive routes CVSS 3.1HIGH 8.8
TI-2019-08446 A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVSS 3.1HIGH 8.6
TI-2018-01109 Insufficient session expiration in Dell EMC Cloud Controller CVSS 3.1HIGH 8.8
TI-2018-01106 Information disclosure in Cloud Foundry Garden-runC CVSS 3.0HIGH 8.8

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences