{"id":"CVE-2019-3790","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-3790","generatedAt":"2026-10-27T23:25:48.314Z","title":"A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.","description":"The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.","published":"2019-06-06T19:29:01.000Z","lastModified":"2026-06-17T02:35:36.000Z","status":"Modified","sourceIdentifier":"security_alert@emc.com","cvss":{"version":"3.0","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-324","CWE-613"],"affected":["pivotal software/operations manager"],"epss":{"score":0.00651,"percentile":0.50906,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.65%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/108512","tags":["Third Party Advisory","VDB Entry"],"source":"security_alert@emc.com"},{"url":"https://pivotal.io/security/cve-2019-3790","tags":["Vendor Advisory"],"source":"security_alert@emc.com"},{"url":"http://www.securityfocus.com/bid/108512","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://pivotal.io/security/cve-2019-3790","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-3790","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}