VDB
CVE-2019-5531
CVE-2019-5531
PUBLISHED
CVSS 5.400000095367432 MEDIUM
VMware vSphere ESXi (6.7 prior to ESXi670-201904101-SG, 6.5 prior to ESXi650-201907101-SG, 6.0 prior to ESXi600-201909001) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user?s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
EPSS 0.38% · 59.8th percentile
Risk Scores
CVSS v3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score
0.38%
59.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| vmware | esxi | 6.7 |
| vmware | vcenter_server | 6.0, 6.0, 6.0 |
| vmware | vsphere_esxi | 6.0, 6.5, 6.7 |
| VMware | VMware vCenter Server | 6.5 prior to 6.5 U2b, *, 6.7 prior to 6.7 U1b |
| VMware | VMware vSphere ESXi | 6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, * |
Timeline
- Sep 17, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 22, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 27, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 5, 2022 EPSS Score