CVE-2019-5533

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.vmware.com/security/advisories/VMSA-2019-0017.html	Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2019-0017.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vmware:sd-wan_by_velocloud:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:45

Type	Values Removed	Values Added
References	~~() https://www.vmware.com/security/advisories/VMSA-2019-0017.html - Vendor Advisory~~	() https://www.vmware.com/security/advisories/VMSA-2019-0017.html - Vendor Advisory

Information

Published : 2019-10-29 19:15

Updated : 2024-11-21 04:45

NVD link : CVE-2019-5533

Mitre link : CVE-2019-5533

CVE.ORG link : CVE-2019-5533

JSON object : View

Products Affected

vmware

sd-wan_by_velocloud

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2019-5533", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2019-10-29T19:15:21.767", "references": [{"url": "https://www.vmware.com/security/advisories/VMSA-2019-0017.html", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}, {"url": "https://www.vmware.com/security/advisories/VMSA-2019-0017.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3."}, {"lang": "es", "value": "En VMware SD-WAN de VeloCloud versiones 3.x anteriores a 3.3.0, la comprobaci\u00f3n de autorizaci\u00f3n del par\u00e1metro VeloCloud Orchestrator permite por error a usuarios empresariales obtener informaci\u00f3n de las cuentas de Managed Service Provider. Entre la informaci\u00f3n est\u00e1 el nombre de usuario, nombre y apellido, n\u00fameros de tel\u00e9fono y direcci\u00f3n de correo electr\u00f3nico si est\u00e1n presentes, pero no otros datos personales. VMware ha evaluado la gravedad de este problema para estar en el rango de gravedad moderada con una puntuaci\u00f3n base m\u00e1xima de CVSSv3 de 4.3."}], "lastModified": "2024-11-21T04:45:08.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:sd-wan_by_velocloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA883F30-B548-47BA-BCB1-E270732D5544", "versionEndExcluding": "3.3.0", "versionStartIncluding": "3.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}