Information disclosure in Pivotal Ops Manager
CVE-2019-11292
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.011 (63.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 63.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Pivotal Ops Manager — versions 2.7, 2.6, 2.5
- Pivotal Software Operations Manager
Weakness classification (CWE)
References
- pivotal.io/security/cve-2019-11292 (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11292?
- CVE-2019-11292 is a medium-severity vulnerability in Pivotal Ops Manager, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.5/10. Published 2020-01-09.
- How severe is CVE-2019-11292?
- Medium severity. CVSS v3 base score is 6.5 out of 10.