Pivotal Ops Manager vulnerabilities

3 vulnerabilities

Known vulnerabilities in Pivotal Ops Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2019-11292pivotal_softwareoperations_manager+1
EPSS score
1.07%
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.6.1CVE-2019-3790pivotal_softwareoperations_manager+1
EPSS score
0.65%
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.7.2CVE-2019-3776pivotal_softwareoperations_manager+1
EPSS score
0.85%
Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.