CVE-2019-11242

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-12 · updated 2026-06-17
Weakness: CWE-295

Description

A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter.

Affected products

Cohesity Dataplatform: from 5.0 before 6.1.1c — fixed in 6.1.1c

How to fix

Upgrade to a fixed version: Cohesity Dataplatform 6.1.1c. Check the vendor advisory for mitigations.

References

https://github.com/cohesity/SecAdvisory/blob/master/README.md
https://github.com/cohesity/SecAdvisory/blob/master/README.md

Get alerted when CVE-2019-11242 or the next vulnerability affects your stack