CVE-2019-3776

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.

CVSS v3 7.2 HIGH
CVSS v2.0 3.5 LOW

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L

Exploitability : 1.3 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/107344	Third Party Advisory VDB Entry
https://pivotal.io/security/cve-2019-3776	Vendor Advisory
http://www.securityfocus.com/bid/107344	Third Party Advisory VDB Entry
https://pivotal.io/security/cve-2019-3776	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pivotal_software:operations_manager::::::::
	cpe:2.3:a:pivotal_software:operations_manager::::::::
	cpe:2.3:a:pivotal_software:operations_manager::::::::
	cpe:2.3:a:pivotal_software:operations_manager::::::::

History

21 Nov 2024, 04:42

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/107344 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/107344 - Third Party Advisory, VDB Entry
References	~~() https://pivotal.io/security/cve-2019-3776 - Vendor Advisory~~	() https://pivotal.io/security/cve-2019-3776 - Vendor Advisory
CVSS	v2 : ~~3.5~~ v3 : ~~5.4~~	v2 : 3.5 v3 : 7.2

Information

Published : 2019-03-07 18:29

Updated : 2024-11-21 04:42

NVD link : CVE-2019-3776

Mitre link : CVE-2019-3776

CVE.ORG link : CVE-2019-3776

JSON object : View

Products Affected

pivotal_software

operations_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-3776", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2019-03-07T18:29:00.413", "references": [{"url": "http://www.securityfocus.com/bid/107344", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security_alert@emc.com"}, {"url": "https://pivotal.io/security/cve-2019-3776", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "http://www.securityfocus.com/bid/107344", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pivotal.io/security/cve-2019-3776", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser."}, {"lang": "es", "value": "Pivotal Operations Manager, en las versiones 2.1.x anteriores a la 2.1.20, en las 2.2.x anteriores a la 2.2.16, en las 2.3.x anteriores a la 2.3.10 y en las 2.4.x anteriores a la 2.4.3, contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado. Un usuario que fuera capaz de convencer a un usuario de Operations Manager para que interactuase con el contenido malicioso podr\u00eda ejecutar c\u00f3digo JavaScript arbitrario en el navegador del usuario."}], "lastModified": "2024-11-21T04:42:31.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E9BCD2D-2334-4699-B965-77319572FD16", "versionEndExcluding": "2.1.20", "versionStartIncluding": "2.1.0"}, {"criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9F206D8-902B-49BF-B1DE-D0FF3674D559", "versionEndExcluding": "2.2.16", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10C5B035-355F-447E-8717-26789EAFC8F9", "versionEndExcluding": "2.3.10", "versionStartIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90F061DB-885E-4AAB-B8A4-CDF0A274DCC6", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}