Medium severity · published Mar 7, 2019
CVE-2019-3776
Reflected XSS in Pivotal Operations Manager
5.4
CVSS
0.8%
EPSS
No
On KEV
Description
Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Pivotal Ops Manager · Pivotal
2.2 before 2.2.16; 2.3 before 2.3.10; 2.4 before 2.4.3; 2.1 before 2.1.19 · source: vendor
OM
Operations Manager · Pivotal Software
2.1.0 before 2.1.20; 2.2.0 before 2.2.16; 2.3.0 before 2.3.10; 2.4.0 before 2.4.3 · source: NVD