VULNERABILITY INTELLIGENCE

CVE-2019-3790

CVSS score6.1 MEDIUM

EPSS probability0.65%

CISA KEVNot currently listed

Published2019-06-06

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Description

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Weakness classification

CWE-324: Use of a Key Past its Expiration Date
CWE-613: Insufficient Session Expiration

Primary references

security_alert@emc.com — Third Party Advisory, VDB Entry
security_alert@emc.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory