CVE-2019-3790 - Ops Manager uaa client issues tokens after refresh token expiration

Back Back to CVE browser

MEDIUM

Ops Manager uaa client issues tokens after refresh token expiration

Published Jun 6, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 0.65%

Description

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Affected products

Vendor Pivotal Product Pivotal Ops Manager Default
n/a
- Version
  2.2
  Status
  affected
  Constraints
  <2.2.23
- Version
  2.3
  Status
  affected
  Constraints
  <2.3.16
- Version
  2.4
  Status
  affected
  Constraints
  <2.4.11
- Version
  2.5
  Status
  affected
  Constraints
  <2.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pivotal

Pivotal Ops Manager

n/a

Version	Status	Constraints
2.2	affected	<2.2.23
2.3	affected	<2.3.16
2.4	affected	<2.4.11
2.5	affected	<2.5.3

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-324

CWE-613

References (3)

http://www.securityfocus.com/bid/108512
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13421
Advisory
https://pivotal.io/security/cve-2019-3790
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/108512		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13421		Advisory
https://pivotal.io/security/cve-2019-3790		x_refsource_CONFIRMVendor Advisory