CVE-2019-3790: Ops Manager uaa client issues tokens after refresh token expiration
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3790?
CVE-2019-3790 is a vulnerability in Pivotal Ops Manager that allows a remote authenticated user to gain access to a browser session.
Which versions of Pivotal Ops Manager are affected by CVE-2019-3790?
Pivotal Ops Manager versions 2.2.x prior to 2.2.23, 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.11, and 2.5.x prior to 2.5.3 are affected by CVE-2019-3790.
How severe is CVE-2019-3790?
CVE-2019-3790 has a severity rating of 5.4, which is considered medium.
How can a remote authenticated user exploit CVE-2019-3790?
A remote authenticated user can exploit CVE-2019-3790 by circumventing the refresh token expiration and gaining access to a browser session.
Where can I find more information about CVE-2019-3790?
You can find more information about CVE-2019-3790 at the following references: [link1](http://www.securityfocus.com/bid/108512) and [link2](https://pivotal.io/security/cve-2019-3790).