What’s Vulnerable › Vulnerabilities

CVE-2019-11292: Pivotal Ops Manager logs query parameters in tomcat access file

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-09 · updated 2026-06-17
• Weakness: CWE-532

Description

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.

Affected products

• Pivotal Ops Manager: from 2.4.0 before 2.4.27; from 2.5.0 before 2.5.24; from 2.6.0 before 2.6.16; from 2.7.0 before 2.7.5 — fixed in 2.4.27, 2.5.24, 2.6.16, 2.7.5

How to fix

Upgrade to a fixed version: Pivotal Ops Manager 2.4.27, 2.5.24, 2.6.16, 2.7.5. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2019-11292
• https://pivotal.io/security/cve-2019-11292

Get alerted when CVE-2019-11292 or the next vulnerability affects your stack