Pivotal Ops Manager CVE-2019-3790 Unauthorized Access Vulnerability

Bugtraq ID:	108512
Class:	Design Error
CVE:	CVE-2019-3790
Remote:	Yes
Local:	No
Published:	May 24 2019 12:00AM
Updated:	May 24 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Pivotal Cloud Foundry Ops Manager 2.5.2 Pivotal Cloud Foundry Ops Manager 2.5.1 Pivotal Cloud Foundry Ops Manager 2.5 Pivotal Cloud Foundry Ops Manager 2.4.10 Pivotal Cloud Foundry Ops Manager 2.4.9 Pivotal Cloud Foundry Ops Manager 2.4.8 Pivotal Cloud Foundry Ops Manager 2.4.7 Pivotal Cloud Foundry Ops Manager 2.4.6 Pivotal Cloud Foundry Ops Manager 2.4.5 Pivotal Cloud Foundry Ops Manager 2.4.4 Pivotal Cloud Foundry Ops Manager 2.4.3 Pivotal Cloud Foundry Ops Manager 2.4.2 Pivotal Cloud Foundry Ops Manager 2.4.1 Pivotal Cloud Foundry Ops Manager 2.4 Pivotal Cloud Foundry Ops Manager 2.3.15 Pivotal Cloud Foundry Ops Manager 2.3.14 Pivotal Cloud Foundry Ops Manager 2.3.12 Pivotal Cloud Foundry Ops Manager 2.3.11 Pivotal Cloud Foundry Ops Manager 2.3.10 Pivotal Cloud Foundry Ops Manager 2.3.9 Pivotal Cloud Foundry Ops Manager 2.3.8 Pivotal Cloud Foundry Ops Manager 2.3.7 Pivotal Cloud Foundry Ops Manager 2.3.6 Pivotal Cloud Foundry Ops Manager 2.3.5 Pivotal Cloud Foundry Ops Manager 2.3.4 Pivotal Cloud Foundry Ops Manager 2.3.3 Pivotal Cloud Foundry Ops Manager 2.3.2 Pivotal Cloud Foundry Ops Manager 2.3.1 Pivotal Cloud Foundry Ops Manager 2.3 Pivotal Cloud Foundry Ops Manager 2.2.22 Pivotal Cloud Foundry Ops Manager 2.2.21 Pivotal Cloud Foundry Ops Manager 2.2.20 Pivotal Cloud Foundry Ops Manager 2.2.19 Pivotal Cloud Foundry Ops Manager 2.2.18 Pivotal Cloud Foundry Ops Manager 2.2.17 Pivotal Cloud Foundry Ops Manager 2.2.16 Pivotal Cloud Foundry Ops Manager 2.2.15 Pivotal Cloud Foundry Ops Manager 2.2.14 Pivotal Cloud Foundry Ops Manager 2.2.13 Pivotal Cloud Foundry Ops Manager 2.2.12 Pivotal Cloud Foundry Ops Manager 2.2.11 Pivotal Cloud Foundry Ops Manager 2.2.10 Pivotal Cloud Foundry Ops Manager 2.2.9 Pivotal Cloud Foundry Ops Manager 2.2.8 Pivotal Cloud Foundry Ops Manager 2.2.7 Pivotal Cloud Foundry Ops Manager 2.2.6 Pivotal Cloud Foundry Ops Manager 2.2.5 Pivotal Cloud Foundry Ops Manager 2.2.4 Pivotal Cloud Foundry Ops Manager 2.2.3 Pivotal Cloud Foundry Ops Manager 2.2.2 Pivotal Cloud Foundry Ops Manager 2.2.1 Pivotal Cloud Foundry Ops Manager 2.2
Not Vulnerable:	Pivotal Cloud Foundry Ops Manager 2.5.3 Pivotal Cloud Foundry Ops Manager 2.4.11 Pivotal Cloud Foundry Ops Manager 2.3.16 Pivotal Cloud Foundry Ops Manager 2.2.23

Pivotal Ops Manager CVE-2019-3790 Unauthorized Access Vulnerability

Pivotal Ops Manager is prone to an unauthorized-access vulnerability.

Attackers can exploit this issue to gain unauthorized access and perform unauthorized actions. This may aid in further attacks.

The following products are affected:

Pivotal Ops Manager 2.2.x versions prior to 2.2.23
Pivotal Ops Manager 2.3.x versions prior to 2.3.16
Pivotal Ops Manager 2.4.x versions prior to 2.4.11
Pivotal Ops Manager 2.5.x versions prior to 2.5.3

Pivotal Ops Manager CVE-2019-3790 Unauthorized Access Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pivotal Ops Manager CVE-2019-3790 Unauthorized Access Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pivotal Ops Manager CVE-2019-3790 Unauthorized Access Vulnerability

References:

• Ops Manager Homepage (Pivotal Software)
  
• Pivotal Homepage (Pivotal)
  
• CVE-2019-3790: Ops Manager uaa client issues tokens after refresh token expirati (Pivotal Software)