CVE-2019-3790

Ops Manager uaa client issues tokens after refresh token expiration

State: Published
Severity: 6.1 Medium
Published: Jun 6, 2019
Updated: Sep 16, 2024
Reserved: Jan 3, 2019

Description

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Scores

CVSS	Score	Vector	Source
3.0	6.1 Medium	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N	dell

Weaknesses

CWE-324 Use of a Key Past its Expiration Date

Affected Products

Product	Versions
Pivotal Ops ManagerPivotal	2.3 to before 2.3.16Affected 2.4 to before 2.4.11Affected 2.2 to before 2.2.23Affected 2.5 to before 2.5.3Affected

References

108512vdb-entry
https://pivotal.io/security/cve-2019-3790

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.