5.8

CVE-2019-5531

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ ESXi Version6.7 Update670-201811001
VMware ≫ Vsphere Esxi Version6.7
VMware ≫ Vsphere Esxi Version6.7 Updateupdate_1
VMware ≫ Vsphere Esxi Version6.5 Updatea
VMware ≫ Vsphere Esxi Version6.5 Updateu2
VMware ≫ Vsphere Esxi Version6.5
VMware ≫ Vsphere Esxi Version6.5 Update650-201810002
VMware ≫ Vsphere Esxi Version6.5 Update650-201811001
VMware ≫ Vsphere Esxi Version6.5 Update650-201811002
VMware ≫ Vsphere Esxi Version6.5 Update650-201901001
VMware ≫ Vsphere Esxi Version6.5 Update650-201903001
VMware ≫ Vsphere Esxi Version6.5 Update650-201905001
VMware ≫ Vsphere Esxi Version6.5 Updateupdate_1
VMware ≫ Vsphere Esxi Version6.0
VMware ≫ Vsphere Esxi Version6.0 Update600-201810001
VMware ≫ Vsphere Esxi Version6.0 Update600-201811001
VMware ≫ Vsphere Esxi Version6.0 Update600-201903001
VMware ≫ Vsphere Esxi Version6.0 Update600-201905001
VMware ≫ Vsphere Esxi Version6.0 Updatebeta
VMware ≫ Vsphere Esxi Version6.0 Updateu1a
VMware ≫ Vsphere Esxi Version6.0 Updateu1b
VMware ≫ Vsphere Esxi Version6.0 Updateu3a
VMware ≫ Vsphere Esxi Version6.0 Updateupdate_2
VMware ≫ Vsphere Esxi Version6.0 Updateupdate_3
VMware ≫ Vcenter Server Version6.0
VMware ≫ Vcenter Server Version6.0 Updatea
VMware ≫ Vcenter Server Version6.0 Updateb
VMware ≫ Vcenter Server Version6.0 Updateu1
VMware ≫ Vcenter Server Version6.0 Updateu1b
VMware ≫ Vcenter Server Version6.0 Updateu3
VMware ≫ Vcenter Server Version6.0 Updateupdate2
VMware ≫ Vcenter Server Version6.0 Updateupdate2a
VMware ≫ Vcenter Server Version6.0 Updateupdate2m
VMware ≫ Vcenter Server Version6.0 Updateupdate3a
VMware ≫ Vcenter Server Version6.0 Updateupdate3b
VMware ≫ Vcenter Server Version6.0 Updateupdate3c
VMware ≫ Vcenter Server Version6.0 Updateupdate3d
VMware ≫ Vcenter Server Version6.0 Updateupdate3e
VMware ≫ Vcenter Server Version6.0 Updateupdate3f
VMware ≫ Vcenter Server Version6.0 Updateupdate3g
VMware ≫ Vcenter Server Version6.0 Updateupdate3h
VMware ≫ Vcenter Server Version6.0 Updateupdate3i
VMware ≫ Vcenter Server Version6.7
VMware ≫ Vcenter Server Version6.7 Updatea
VMware ≫ Vcenter Server Version6.7 Updateb
VMware ≫ Vcenter Server Version6.7 Updatec
VMware ≫ Vcenter Server Version6.7 Updated
VMware ≫ Vcenter Server Version6.7 Updateupdate1
VMware ≫ Vcenter Server Version6.7 Updateupdate1b
VMware ≫ Vcenter Server Version6.7 Updateupdate2
VMware ≫ Vcenter Server Version6.7 Updateupdate2a
VMware ≫ Vcenter Server Version6.7 Updateupdate2c
VMware ≫ Vcenter Server Version6.5
VMware ≫ Vcenter Server Version6.5 Updatea
VMware ≫ Vcenter Server Version6.5 Updateb
VMware ≫ Vcenter Server Version6.5 Updatec
VMware ≫ Vcenter Server Version6.5 Updated
VMware ≫ Vcenter Server Version6.5 Updateupdate1
VMware ≫ Vcenter Server Version6.5 Updateupdate1b
VMware ≫ Vcenter Server Version6.5 Updateupdate1c
VMware ≫ Vcenter Server Version6.5 Updateupdate1d
VMware ≫ Vcenter Server Version6.5 Updateupdate1e
VMware ≫ Vcenter Server Version6.5 Updateupdate1g
VMware ≫ Vcenter Server Version6.5 Updateupdate2
VMware ≫ Vcenter Server Version6.5 Updateupdate2b
VMware ≫ Vcenter Server Version6.5 Updateupdate2c
VMware ≫ Vcenter Server Version6.5 Updateupdate2d
VMware ≫ Vcenter Server Version6.5 Updateupdate2g
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.75% 0.722
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."