CVE-2019-11292

Pivotal Ops Manager logs query parameters in tomcat access file

State: Published
Severity: 8.8 High
Published: Jan 8, 2020
Updated: Sep 16, 2024
Reserved: Apr 18, 2019

Description

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	pivotal

Weaknesses

CWE-532 Inclusion of Sensitive Information in Log Files

Affected Products

Product	Versions
Pivotal Ops ManagerPivotal	2.7 to before 2.7.5Affected 2.6 to before 2.6.16Affected 2.5 to before 2.5.24Affected 2.4 to before 2.4.27Affected

References

https://pivotal.io/security/cve-2019-11292

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.