CVE-2019-11292

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Score

CVSS 3.0 8.8 High

Status

Modified - security@pivotal.io

Published

2020-01-09

Last modified

2024-09-16

Weaknesses

CWE-532

Affected products

• Pivotal Ops Manager (Pivotal)
• Operations Manager (Pivotal Software)

References

• https://pivotal.io/security/cve-2019-11292