CVE-2019-5531 Information disclosure in VMware vCenter Server
Attackers with physical access or websocket mimicry can hijack VM consoles after user logout due to insufficient session expiration in VMware vSphere and vCenter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-5531?
CVE-2019-5531 is a medium-severity vulnerability in Vmware Esxi, published on 18 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
VMware vSphere ESXi (6.7 prior to ESXi670-201810101-SG, 6.5 prior to ESXi650-201811102-SG, and 6.0 prior to ESXi600-201807103-SG) and VMware vCenter Server (6.7 prior to 6.7 U1b, 6.5 prior to 6.5 U2b, and 6.0 prior to 6.0 U3j) contain an information disclosure vulnerability in clients arising from insufficient session expiration. An attacker with physical access or an ability to mimic a websocket connection to a user’s browser may be able to obtain control of a VM Console after the user has logged out or their session has timed out.
Weakness: CWE-613
Which versions are affected by CVE-2019-5531?
It affects 3 products.
Products include Vmware Esxi, Vmware Vcenter Server, Vmware Vsphere Esxi.
How do I fix CVE-2019-5531?
No fix has been published for CVE-2019-5531 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5531 being exploited?
There is no known exploitation of CVE-2019-5531 in the wild and no public exploit code.
Other vulnerabilities in Vmware Esxi
Sources
Also known as GHSA-7623-hj89-p4cw.