5.8

CVE-2019-5531

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ ESXi Version 6.7 Update 670-201811001
VMware ≫ Vsphere Esxi Version 6.7
VMware ≫ Vsphere Esxi Version 6.7 Update update_1
VMware ≫ Vsphere Esxi Version 6.5 Update a
VMware ≫ Vsphere Esxi Version 6.5 Update u2
VMware ≫ Vsphere Esxi Version 6.5
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201810002
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201811001
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201811002
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201901001
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201903001
VMware ≫ Vsphere Esxi Version 6.5 Update 650-201905001
VMware ≫ Vsphere Esxi Version 6.5 Update update_1
VMware ≫ Vsphere Esxi Version 6.0
VMware ≫ Vsphere Esxi Version 6.0 Update 600-201810001
VMware ≫ Vsphere Esxi Version 6.0 Update 600-201811001
VMware ≫ Vsphere Esxi Version 6.0 Update 600-201903001
VMware ≫ Vsphere Esxi Version 6.0 Update 600-201905001
VMware ≫ Vsphere Esxi Version 6.0 Update beta
VMware ≫ Vsphere Esxi Version 6.0 Update u1a
VMware ≫ Vsphere Esxi Version 6.0 Update u1b
VMware ≫ Vsphere Esxi Version 6.0 Update u3a
VMware ≫ Vsphere Esxi Version 6.0 Update update_2
VMware ≫ Vsphere Esxi Version 6.0 Update update_3
VMware ≫ vCenter Server Version 6.0
VMware ≫ vCenter Server Version 6.0 Update a
VMware ≫ vCenter Server Version 6.0 Update b
VMware ≫ vCenter Server Version 6.0 Update u1
VMware ≫ vCenter Server Version 6.0 Update u1b
VMware ≫ vCenter Server Version 6.0 Update u3
VMware ≫ vCenter Server Version 6.0 Update update2
VMware ≫ vCenter Server Version 6.0 Update update2a
VMware ≫ vCenter Server Version 6.0 Update update2m
VMware ≫ vCenter Server Version 6.0 Update update3a
VMware ≫ vCenter Server Version 6.0 Update update3b
VMware ≫ vCenter Server Version 6.0 Update update3c
VMware ≫ vCenter Server Version 6.0 Update update3d
VMware ≫ vCenter Server Version 6.0 Update update3e
VMware ≫ vCenter Server Version 6.0 Update update3f
VMware ≫ vCenter Server Version 6.0 Update update3g
VMware ≫ vCenter Server Version 6.0 Update update3h
VMware ≫ vCenter Server Version 6.0 Update update3i
VMware ≫ vCenter Server Version 6.7
VMware ≫ vCenter Server Version 6.7 Update a
VMware ≫ vCenter Server Version 6.7 Update b
VMware ≫ vCenter Server Version 6.7 Update c
VMware ≫ vCenter Server Version 6.7 Update d
VMware ≫ vCenter Server Version 6.7 Update update1
VMware ≫ vCenter Server Version 6.7 Update update1b
VMware ≫ vCenter Server Version 6.7 Update update2
VMware ≫ vCenter Server Version 6.7 Update update2a
VMware ≫ vCenter Server Version 6.7 Update update2c
VMware ≫ vCenter Server Version 6.5
VMware ≫ vCenter Server Version 6.5 Update a
VMware ≫ vCenter Server Version 6.5 Update b
VMware ≫ vCenter Server Version 6.5 Update c
VMware ≫ vCenter Server Version 6.5 Update d
VMware ≫ vCenter Server Version 6.5 Update update1
VMware ≫ vCenter Server Version 6.5 Update update1b
VMware ≫ vCenter Server Version 6.5 Update update1c
VMware ≫ vCenter Server Version 6.5 Update update1d
VMware ≫ vCenter Server Version 6.5 Update update1e
VMware ≫ vCenter Server Version 6.5 Update update1g
VMware ≫ vCenter Server Version 6.5 Update update2
VMware ≫ vCenter Server Version 6.5 Update update2b
VMware ≫ vCenter Server Version 6.5 Update update2c
VMware ≫ vCenter Server Version 6.5 Update update2d
VMware ≫ vCenter Server Version 6.5 Update update2g
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.97% 0.574
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

http://www.vmware.com/security/advisories/VMSA-2019-0013.html