Design/Logic Flaw

2019-06-0619:29:00

PRIOn knowledge base

www.prio-n.com

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.5%

JSON

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

CPENameOperatorVersion
operations_managerge2.4.0
operations_managerlt2.4.11
operations_managerge2.3.0
operations_managerlt2.3.16
operations_managerge2.2.0
operations_managerlt2.2.23
operations_managerge2.5.0
operations_managerlt2.5.3

Name	Operator	Version
operations_manager	ge	2.4.0
operations_manager	lt	2.4.11
operations_manager	ge	2.3.0
operations_manager	lt	2.3.16
operations_manager	ge	2.2.0
operations_manager	lt	2.2.23
operations_manager	ge	2.5.0
operations_manager	lt	2.5.3

References

www.securityfocus.com/bid/108512

pivotal.io/security/cve-2019-3790