CVE-2019-3790: Ops Manager uaa client issues tokens after refresh token expiration
First published: Thu Jun 06 2019(Updated: )
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pivotal Operations Manager | >=2.2.0<2.2.23 | |
| Pivotal Operations Manager | >=2.3.0<2.3.16 | |
| Pivotal Operations Manager | >=2.4.0<2.4.11 | |
| Pivotal Operations Manager | >=2.5.0<2.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-3790?
CVE-2019-3790 is a vulnerability in Pivotal Ops Manager that allows a remote authenticated user to gain access to a browser session.
Which versions of Pivotal Ops Manager are affected by CVE-2019-3790?
Pivotal Ops Manager versions 2.2.x prior to 2.2.23, 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.11, and 2.5.x prior to 2.5.3 are affected by CVE-2019-3790.
How severe is CVE-2019-3790?
CVE-2019-3790 has a severity rating of 5.4, which is considered medium.
How can a remote authenticated user exploit CVE-2019-3790?
A remote authenticated user can exploit CVE-2019-3790 by circumventing the refresh token expiration and gaining access to a browser session.
Where can I find more information about CVE-2019-3790?
You can find more information about CVE-2019-3790 at the following references: [link1](http://www.securityfocus.com/bid/108512) and [link2](https://pivotal.io/security/cve-2019-3790).
- agent/references
- agent/type
- agent/weakness
- agent/softwarecombine
- agent/severity
- agent/title
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/pivotal software
- canonical/pivotal operations manager
- version/pivotal operations manager/2.2.0
- version/pivotal operations manager/2.3.0
- version/pivotal operations manager/2.4.0
- version/pivotal operations manager/2.5.0