CVE-2019-11292: Pivotal Ops Manager logs query parameters in tomcat access file
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Other sources
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-11292?
CVE-2019-11292 is a vulnerability in Pivotal Ops Manager versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, which logs all query parameters to tomcat's access file, including authentication credentials.
What software is affected by CVE-2019-11292?
Pivotal Software Operations Manager versions 2.4.x to 2.4.27, 2.5.x to 2.5.24, 2.6.x to 2.6.16, and 2.7.x to 2.7.5 are affected by CVE-2019-11292.
How severe is CVE-2019-11292?
CVE-2019-11292 has a severity rating of 6.5 (High).
How can I fix CVE-2019-11292?
To fix CVE-2019-11292, update Pivotal Ops Manager to version 2.4.27, 2.5.24, 2.6.16, or 2.7.5 or later.
Where can I find more information about CVE-2019-11292?
You can find more information about CVE-2019-11292 at [this link](https://pivotal.io/security/cve-2019-11292).