PT-2019-2592 · Vmware · Vcloud Director

Andrew Kramer + 3 · Published 2019-03-28 · Updated 2019-04-04 · CVE-2019-5523

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCloud Director for Service Providers versions 9.5.x prior to 9.5.0.3

Description The issue is related to incorrect session management in the vCloud Director platform, which may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged-in session. Successful exploitation of this issue can enable a remote attacker to hijack remote sessions.

Recommendations For versions 9.5.x prior to 9.5.0.3, update to version 9.5.0.3 to resolve the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2019-02472

CVE-2019-5523

Affected Products

Vcloud Director

References · 6

• https://vmware.com/security/advisories/VMSA-2019-0004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5523 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5523 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02472 · Security Note
• http://packetstormsecurity.com/files/152289/VMware-Security-Advisory-2019-0004.html · Note
• http://securityfocus.com/bid/107638 · Note