CVE-2019-11292: Pivotal Ops Manager logs query parameters in tomcat access file
First published: Wed Jan 08 2020(Updated: )
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Credit: security@pivotal.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Software Operations Manager | >=2.4.0<2.4.27 | |
| Pivotal Software Operations Manager | >=2.5.0<2.5.24 | |
| Pivotal Software Operations Manager | >=2.6.0<2.6.16 | |
| Pivotal Software Operations Manager | >=2.7.0<2.7.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11292?
CVE-2019-11292 is a vulnerability in Pivotal Ops Manager versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, which logs all query parameters to tomcat's access file, including authentication credentials.
What software is affected by CVE-2019-11292?
Pivotal Software Operations Manager versions 2.4.x to 2.4.27, 2.5.x to 2.5.24, 2.6.x to 2.6.16, and 2.7.x to 2.7.5 are affected by CVE-2019-11292.
How severe is CVE-2019-11292?
CVE-2019-11292 has a severity rating of 6.5 (High).
How can I fix CVE-2019-11292?
To fix CVE-2019-11292, update Pivotal Ops Manager to version 2.4.27, 2.5.24, 2.6.16, or 2.7.5 or later.
Where can I find more information about CVE-2019-11292?
You can find more information about CVE-2019-11292 at [this link](https://pivotal.io/security/cve-2019-11292).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/references
- agent/weakness
- agent/title
- agent/author
- agent/severity
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/pivotal software
- canonical/pivotal software operations manager
- version/pivotal software operations manager/2.4.0
- version/pivotal software operations manager/2.5.0
- version/pivotal software operations manager/2.6.0
- version/pivotal software operations manager/2.7.0