Support Content Notification - Support Portal

VMSA-2019-0004:VMware vCloud Director for Service Providers update resolves a Remote Session Hijack vulnerability

Product/Component

VMware

0 more products

Notification Id

23528

Last Updated

26 March 2019

Initial Publication Date

26 March 2019

Status

CLOSED

Severity

CRITICAL

CVSS Base Score

9.5.x

WorkAround

Affected CVE

CVE-2019-5523

VMSA-2019-0004

VMware vCloud Director for Service Providers update resolves a Remote Session Hijack vulnerability

VMware Security Advisory

VMware Security Advisory Advisory ID:

VMSA-2019-0004

VMware Security Advisory Severity:

Critical

VMware Security Advisory Synopsis:

VMware vCloud Director for Service Providers update resolves a Remote Session Hijack vulnerability

VMware Security Advisory Issue date:

2019-03-28

VMware Security Advisory Updated on:

2019-03-28 (Initial Advisory)

VMware Security Advisory CVE numbers:

CVE-2019-5523

1. Summary

VMware vCloud Director for Service Providers update resolves a Remote Session Hijack vulnerability

2. Relevant Products

-VMware vCloud Director for Service Providers (vCD)

3. Problem Description

VMware vCloud Director for Service Providers update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

VMware would like to thank Tyler Flaagan, Eric Holm, Andrew Kramer, and Logan Stratton of Dakota State University for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5523 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.

VMware Product	Product Version	Running On	Severity	Replace_with/Apply_Patch	Mitigation/Workaround
vCD	9.7.x	Any	N/A	Unaffected	None
vCD	9.5.x	Any	Critical	9.5.0.3	None
vCD	9.1.x	Any	N/A	Unaffected	None
vCD	9.0.x	Any	N/A	Unaffected	None

4. Solution

Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.

VMware vCloud Director for Service Providers 9.5.0.3

Documentation and Downloads:

https://my.vmware.com/en/web/vmware/info/slug/datacenter_cloud_infrastructure/vmware_vcloud_director/9_5

5. References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5523

6. Change log

2019-03-28: VMSA-2019-0004

Initial security advisory in conjunction with the release of VMware vCloud Director for Service Providers 9.5.0.3 on 2019-03-28.

7. Contact

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

This Security Advisory is posted to the following lists:

[email protected]

E-mail: [email protected]

PGP key at:

https://kb.vmware.com/kb/1055

VMware Security Advisories

https://www.vmware.com/security/advisories

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html

VMware Security & Compliance Blog

https://blogs.vmware.com/security

Twitter

https://twitter.com/VMwareSRC