PT-2019-2592 · Vmware · Vcloud Director

Andrew Kramer + 3 · Publicado 2019-03-28 · Atualizado 2019-04-04 · CVE-2019-5523

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCloud Director for Service Providers versions 9.5.x prior to 9.5.0.3

Description The issue is related to incorrect session management in the vCloud Director platform, which may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged-in session. Successful exploitation of this issue can enable a remote attacker to hijack remote sessions.

Recommendations For versions 9.5.x prior to 9.5.0.3, update to version 9.5.0.3 to resolve the issue.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

BDU:2019-02472

CVE-2019-5523

Produtos afetados

Vcloud Director

Referências · 6

• https://vmware.com/security/advisories/VMSA-2019-0004.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5523 · Nota de Segurança
• http://packetstormsecurity.com/files/152289/VMware-Security-Advisory-2019-0004.html · Nota
• https://osv.dev/vulnerability/CVE-2019-5523 · Aviso do Fabricante
• http://securityfocus.com/bid/107638 · Nota
• https://bdu.fstec.ru/vul/2019-02472 · Nota de Segurança