VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
User Interaction Required
No CVSS v3.0
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None
AV:N/AC:M/Au:N/C:P/I:P/A:N
Vendors | Products |
---|---|
Vmware |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
Configuration 3 [-]
|
Configuration 4 [-]
|
Configuration 5 [-]
|
Configuration 6 [-]
|
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: vmware
Published: 2019-09-18T21:42:17
Updated: 2019-09-20T18:18:52
Reserved: 2019-01-07T00:00:00
Link: CVE-2019-5531
JSON object: View
NVD Information
Status : Modified
Published: 2019-09-18T22:15:11.357
Modified: 2020-02-10T21:53:17.333
Link: CVE-2019-5531
JSON object: View
Redhat Information
No data.
CWE