CVE-2019-5531
Last modified
CVE-2019-5531 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.. EPSS estimates a 0.97% chance of exploitation in the next 30 days.
Description
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Vmware | Esxi | 6.7 | 670-201811001 |
| Vmware | Vsphere Esxi | 6.7 | — |
| Vmware | Vsphere Esxi | 6.5 | A |
| Vmware | Vsphere Esxi | 6.0 | — |
| Vmware | Vcenter Server | 6.0 | — |
| Vmware | Vcenter Server | 6.7 | — |
| Vmware | Vcenter Server | 6.5 | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-5531?
How severe is CVE-2019-5531?
How do I fix CVE-2019-5531?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-5524VMware Workstation (14.x before 14.1.6) and Fusion (10.x bef…
- CVE-2019-5525VMware Workstation (15.x before 15.1.0) contains a use-after…
- CVE-2019-5526VMware Workstation (15.x before 15.1.0) contains a DLL hijac…
- CVE-2019-5527ESXi, Workstation, Fusion, VMRC and Horizon Client contain a…8.8
- CVE-2019-5528VMware ESXi 6.5 suffers from partial denial of service vulne…5.3
- CVE-2019-5530Windows binaries generated with InstallBuilder versions earl…
- CVE-2019-5532VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6…7.7
- CVE-2019-5533In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, t…4.3
- CVE-2019-5534VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6…7.7
- CVE-2019-5535VMware Workstation and Fusion contain a network denial-of-se…4.7
- CVE-2019-5536VMware ESXi (6.7 before ESXi670-201908101-SG and 6.5 before …6.5
- CVE-2019-5537Sensitive information disclosure vulnerability resulting fro…5.9
Are you affected by CVE-2019-5531?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST