Lucene search

VmwareCVE-2019-5533

HistoryOct 29, 2019 - 7:15 p.m.

CVE-2019-5533

2019-10-2919:15:21

CWE-863

vmware

web.nvd.nist.gov

vmware

velocloud

sd-wan

cve-2019-5533

authorization check

security vulnerability

information disclosure

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3.

Affected configurations

Nvd

Node

vmwaresd-wan_by_velocloudRange3.1.1–3.3.0

VendorProductVersionCPE
vmwaresd-wan_by_velocloud*cpe:2.3:a:vmware:sd-wan_by_velocloud:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vmware	sd-wan_by_velocloud	*	cpe:2.3:a:vmware:sd-wan_by_velocloud::::::::

CNA Affected

[
  {
    "product": "SD-WAN by VeloCloud",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "3.x prior to 3.3.0"
      }
    ]
  }
]

References

www.vmware.com/security/advisories/VMSA-2019-0017.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2019-5533