Read the docs
TI-2019-03929 Aliases CVE-2019-5523GHSA-572p-v7cx-fv5g

Session fixation in VMware vCloud Director for Service Providers

Priority MEDIUM 48CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-384.

Summary

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

Why it matters now

EPSS 0.03255 88th percentileScored 2026-11-07
Fix Fixed VMware vCloud Director for Service Providers (vCD) (VMware): 9.5.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareVMware vCloud Director for Service Providers (vCD)9.5 to before 9.5.0.39.5.0.3Patch availableCNA
  • VMware vCloud Director for Service Providers (vCD) VendorVMware Affected 9.5 to before 9.5.0.3 Fixed in 9.5.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcloud_director:*:*:*:*:*:*:*:*9.5.0.0 to before 9.5.0.3VulnerableVMware
  • cpe:2.3:a:vmware:vcloud_director:*:*:*:*:*:*:*:* Versions 9.5.0.0 to before 9.5.0.3 Vulnerable ·VMware

Remediation

  • Fix · CNA VMware vCloud Director for Service Providers (vCD) (VMware) Fixed in 9.5.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5523
  2. 2026-10-03 Alias added: GHSA-572p-v7cx-fv5g

References

Advisory 2

  • TI-2020-03454 Expression language injection in VMware Cloud Director CVSS 3.1HIGH 8.8
  • TI-2022-07143 An authenticated, high privileged malicious actor with network access to the VMware Cloud… CVSS 3.1HIGH 7.2
  • TI-2016-01907 Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0… CVSS 3.0HIGH 7.6
  • TI-2014-00925 Cross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before… CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences