CVE-2019-3790CWE-324

Ops Manager uaa client issues tokens after refresh token expiration

Medium · published June 6, 2019

CVSS v3.0
6.1
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

The record
Technical detail
CVSS v3.0
6.1 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.6th percentile
Weakness
CWE-324 · Use of a Key Past its Expiration Date
Published
2019-06-06T19:16Z
EPSS history
Timeline
  • 06 JUN 19:16Z
    Ops Manager uaa client issues tokens after refresh token expiration
    cvelistv5