CVE-2019-5523
CRITICALVMware vCloud Director for Service Providers <9.5.0.3 - RCE
Title source: llmDescription
VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/152289/VMware-Security-Advisory-2019-0004.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/107638
Vendor Advisory x_refsource_confirm
https://www.vmware.com/security/advisories/VMSA-2019-0004.html
Scores
CVSS v3
9.8
EPSS
0.0245
EPSS Percentile
85.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-384
Status
published
Products (1)
vmware/vcloud_director
9.5.0.0 - 9.5.0.3
Published
Apr 01, 2019
Tracked Since
Feb 18, 2026