CVE-2019-5531

mediumPriorität · verfolgen · 22EPSS 0.010 · 62. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.97% (62nd) EPSS

CVSS 5.8 · medium

Is it mine?

20 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · bewertet 2026-10-26

VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 4.9

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.5

v3.15.4mediumAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-613USprimärCWE-613US

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

VMware VMware vCenter Server≤ 6.7 prior to 6.7 U1benisa_euvdEU
VMware VMware vCenter Server≤ 6.5 prior to 6.5 U2benisa_euvdEU
VMware VMware vCenter Server≤ 6.0 prior to 6.0 U3jenisa_euvdEU
VMware VMware vSphere ESXi≤ 6.0 prior to ESXi600-201807103-SGenisa_euvdEU
VMware VMware vSphere ESXi≤ 6.5 prior to ESXi650-201811102-SGenisa_euvdEU
VMware VMware vSphere ESXi≤ 6.7 prior to ESXi670-201810101-SGenisa_euvdEU
Broadcom Inc. VMware ESXi6.0 → ESXi600-201807103-SGfstec_bduRU
Broadcom Inc. VMware ESXi6.5 → ESXi650-201811102-SGfstec_bduRU
Broadcom Inc. VMware ESXi6.7 → ESXi670-201810101-SGfstec_bduRU
Broadcom Inc. VMware vCenter Server6.0 → 6.0 U3jfstec_bduRU
Broadcom Inc. VMware vCenter Server6.5 → 6.5 U2bfstec_bduRU
Broadcom Inc. VMware vCenter Server6.7 → 6.7 U1bfstec_bduRU
vmware esxi= 6.7nvdUScpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:*
vmware vcenter server= 6.0nvdUScpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*
vmware vcenter server= 6.5nvdUScpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*
vmware vcenter server= 6.7nvdUScpe:2.3:a:vmware:vcenter_server:*:*:*:*:*:*:*:*
vmware vsphere esxi= 6.0nvdUScpe:2.3:o:vmware:vsphere_esxi:*:*:*:*:*:*:*:*
vmware vsphere esxi= 6.5nvdUScpe:2.3:o:vmware:vsphere_esxi:*:*:*:*:*:*:*:*
vmware vsphere esxi= 6.5nvdUScpe:2.3:a:vmware:vsphere_esxi:*:*:*:*:*:*:*:*
vmware vsphere esxi= 6.7nvdUScpe:2.3:o:vmware:vsphere_esxi:*:*:*:*:*:*:*:*

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

veröffentlicht 2019-09-18geändert 2026-06-17

verwandt (730)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2014-2595US	critical9.8	16.9% (97th)	Exploit	2020-02-12
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVE-2020-27422US	critical9.8	7.86% (95th)	Exploit	2020-11-16
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVE-2021-24019US	critical9.8	3.90% (90th)	Exploit	2021-10-06
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user sess…
CVE-2020-29667US	critical9.8	3.23% (88th)	Exploit	2020-12-10
In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system becaus…
CVE-2017-6529US	high8.8	2.90% (87th)	Exploit	2017-03-09
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

+725 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan