Read the docs
TI-2019-02804 Aliases CVE-2019-3790GHSA-73vj-wxr6-3pq5

Ops Manager uaa client issues tokens after refresh token expiration

Priority LOW 28CWE-324Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.

Why it matters now

EPSS 0.00651 51st percentileScored 2026-11-07
Fix Fixed Pivotal Ops Manager (Pivotal): 2.3.16, 2.4.11, 2.2.23 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PivotalPivotal Ops Manager2.3 to before 2.3.16; 2.4 to before 2.4.11; 2.2 to before 2.2.23; 2.5 to before 2.5.32.3.16, 2.4.11, 2.2.23, 2.5.3Patch availableCNA
  • Pivotal Ops Manager VendorPivotal Affected 2.3 to before 2.3.16; 2.4 to before 2.4.11; 2.2 to before 2.2.23; 2.5 to before 2.5.3 Fixed in 2.3.16, 2.4.11, 2.2.23, 2.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*2.2.0 to before 2.2.23; 2.3.0 to before 2.3.16; 2.4.0 to before 2.4.11; 2.5.0 to before 2.5.3VulnerableSpring by Pivotal
  • cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.2.23; 2.3.0 to before 2.3.16; 2.4.0 to before 2.4.11; 2.5.0 to before 2.5.3 Vulnerable ·Spring by Pivotal

Remediation

  • Fix · CNA Pivotal Ops Manager (Pivotal) Fixed in 2.3.16, 2.4.11, 2.2.23, 2.5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3790
  2. 2026-10-03 Alias added: GHSA-73vj-wxr6-3pq5
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2016-04299 When processing authorization requests using the whitelabel views in Spring Security… CVSS 3.0HIGH 8.8
  • TI-2018-01165 Code injection in Pivotal Spring Security OAuth CVSS 3.0CRITICAL 9.8
  • TI-2018-11237 DoS Attack via Range Requests CVSS 3.1HIGH 7.5
  • TI-2019-02791 Apps Manager unverified SSL certs in Cloud Controller proxy CVSS 3.0CRITICAL 9.8
  • TI-2018-11239 On Demand Services SDK Timing Attack Vulnerability CVSS 3.0CRITICAL 9.8
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences