Insufficient Session Expiration in Broadcom products - CVE-2019-5531
Published: September 17, 2019
Vulnerability identifier: #VU21147
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5531
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient session expiration issue. A remote non-authenticated attacker can obtain or guess session token and gain unauthorized access to session that belongs to another user.
Affected software
vCenter Server vSphere Web Client
vCenter Server vSphere Client
VMware ESXi
EMC Integrated Data Protection Appliance
vCenter Server vSphere Client
VMware ESXi
EMC Integrated Data Protection Appliance
How to mitigate CVE-2019-5531
Install updates from vendor's website.
For ESXi systems apply the following patches:
For 6.0 - ESXi600-201909101-SG
For 6.5 - ESXi650-201907101-SG
For 6.7 - ESXi670-201904101-SG
vCenter Server vSphere Web Client - addressed in versions 6.0 U3j, 6.5 U2b, 6.7 U1b
vCenter Server vSphere Client - addressed in versions 6.5 U2b, 6.7 U1b
EMC Integrated Data Protection Appliance - update to 2.3.1
vCenter Server vSphere Client - addressed in versions 6.5 U2b, 6.7 U1b
EMC Integrated Data Protection Appliance - update to 2.3.1