Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2019-3790

Ops Manager uaa client issues tokens after refresh token expiration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Pivotal Pivotal Ops Manager

  • 2.3 to < 2.3.16affected
  • 2.4 to < 2.4.11affected
  • 2.2 to < 2.2.23affected
  • 2.5 to < 2.5.3affected

References