CVE-2019-3790: pivotal_software operations_manager Use of a Key Past its Expiration Date
Vulnerability summary
CVE-2019-3790 is a medium (CVSS 6.1) Use of a Key Past its Expiration Date vulnerability in pivotal_software operations_manager. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities.
Timeline
- 06-06-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
-0.01 pp
From 0.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-324Use of a Key Past its Expiration DateThe product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Pivotal1 product
- pivotal ops manager≥ 2.3, < 2.3.16 | ≥ 2.4, < 2.4.11 | ≥ 2.2, < 2.2.23 | ≥ 2.5, < 2.5.3
Pivotal_software1 product
- operations_manager≥ 2.2.0, < 2.2.23 | ≥ 2.3.0, < 2.3.16 | ≥ 2.4.0, < 2.4.11 | ≥ 2.5.0, < 2.5.3
2 vendors · 2 products