What’s Vulnerable › Vulnerabilities

CVE-2019-3776: Reflected XSS in Pivotal Operations Manager

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-07 · updated 2026-06-17
• Weakness: CWE-79

Description

Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.

Affected products

• Pivotal Ops Manager: from 2.1.0 before 2.1.20; from 2.2.0 before 2.2.16; from 2.3.0 before 2.3.10; from 2.4.0 before 2.4.3 — fixed in 2.1.20, 2.2.16, 2.3.10, 2.4.3

How to fix

Upgrade to a fixed version: Pivotal Ops Manager 2.1.20, 2.2.16, 2.3.10, 2.4.3. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/107344
• https://pivotal.io/security/cve-2019-3776
• http://www.securityfocus.com/bid/107344
• https://pivotal.io/security/cve-2019-3776

Get alerted when CVE-2019-3776 or the next vulnerability affects your stack