Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-3790

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Published

2019-06-06T19:29:00.783

Last Modified

2024-11-21T04:42:32.917

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 6.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-324
  • Type: Primary
    CWE-613
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application pivotal_software operations_manager < 2.2.23 Yes
Application pivotal_software operations_manager < 2.3.16 Yes
Application pivotal_software operations_manager < 2.4.11 Yes
Application pivotal_software operations_manager < 2.5.3 Yes
References