« Volver al listado

CVE-2019-11292

Estado: ModificadaMedia (6.5)—

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pivotal Software — Operations Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-11292",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@pivotal.io",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@pivotal.io",
      "affectedData": [
        {
          "vendor": "Pivotal",
          "product": "Pivotal Ops Manager",
          "versions": [
            {
              "status": "affected",
              "version": "2.7",
              "lessThan": "2.7.5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.6",
              "lessThan": "2.6.16",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.5",
              "lessThan": "2.5.24",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2.4",
              "lessThan": "2.4.27",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-09T00:15:09.683",
  "references": [
    {
      "url": "https://pivotal.io/security/cve-2019-11292",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@pivotal.io"
    },
    {
      "url": "https://pivotal.io/security/cve-2019-11292",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@pivotal.io",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well."
    },
    {
      "lang": "es",
      "value": "Pivotal Ops Manager, versiones 2.4.x anteriores a la versión 2.4.27, 2.5.x anteriores a la versión  2.5.24, 2.6.x anteriores a la versión  2.6.16 y 2.7.x anteriores a  la versión 2.7.5, registra todos los parámetros de consulta en tomcatâ € ™ s archivo de acceso. Si los parámetros de consulta se utilizan para proporcionar autenticación, es decir. credenciales, luego se registrarán también."
    }
  ],
  "lastModified": "2026-06-17T02:12:41.393",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5F7096E-702F-476C-8601-D0190A5F8DEA",
              "versionEndExcluding": "2.4.27",
              "versionStartIncluding": "2.4.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E2CE732-CE67-4E97-B18C-0579024E41CD",
              "versionEndExcluding": "2.5.24",
              "versionStartIncluding": "2.5.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "994739FB-4708-4510-8525-75668696DA75",
              "versionEndExcluding": "2.6.16",
              "versionStartIncluding": "2.6.0"
            },
            {
              "criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "512AE3F3-5ED4-42E4-801E-8CD26A953908",
              "versionEndExcluding": "2.7.5",
              "versionStartIncluding": "2.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@pivotal.io"
}