CVE-2019-3790

5.4 mediumEPSS 0.7%

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWEs: CWE-613, CWE-324
Published: 2019-06-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:operations_manager

References

http://www.securityfocus.com/bid/108512
https://pivotal.io/security/cve-2019-3790
http://www.securityfocus.com/bid/108512
https://pivotal.io/security/cve-2019-3790

Check your stack JSON