Lucene search

DellCVE-2019-3790

HistoryJun 06, 2019 - 7:29 p.m.

CVE-2019-3790

2019-06-0619:29:00

CWE-324

CWE-613

dell

web.nvd.nist.gov

152

pivotal ops manager

cve-2019-3790

token expiration bypass

unauthorized access

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Affected configurations

Nvd

Vulners

Node

pivotal_softwareoperations_managerRange2.2.0–2.2.23

pivotal_softwareoperations_managerRange2.3.0–2.3.16

pivotal_softwareoperations_managerRange2.4.0–2.4.11

pivotal_softwareoperations_managerRange2.5.0–2.5.3

VendorProductVersionCPE
pivotal_softwareoperations_manager*cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pivotal_software	operations_manager	*	cpe:2.3:a:pivotal_software:operations_manager::::::::

CNA Affected

[
  {
    "product": "Pivotal Ops Manager",
    "vendor": "Pivotal",
    "versions": [
      {
        "lessThan": "2.3.16",
        "status": "affected",
        "version": "2.3",
        "versionType": "custom"
      },
      {
        "lessThan": "2.4.11",
        "status": "affected",
        "version": "2.4",
        "versionType": "custom"
      },
      {
        "lessThan": "2.2.23",
        "status": "affected",
        "version": "2.2",
        "versionType": "custom"
      },
      {
        "lessThan": "2.5.3",
        "status": "affected",
        "version": "2.5",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108512

pivotal.io/security/cve-2019-3790

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.3%

JSON

Related for CVE-2019-3790