← Vulnerability feed

Vulnerability record · CVE-2019-5523 · published 1 April 2019

CVE-2019-5523: Vmware vcloud director vulnerability

Vmware · Vcloud Director

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

9.8 CVSS 3.0 Critical EPSS 3.3% · top 12.1% CWE-384 · CWE-384
9.8CVSS 3.0 base score, v2 7.5
3.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

VMware vCloud Director for Service Providers 9.5.x prior to 9.5.0.3 update resolves a Remote Session Hijack vulnerability in the Tenant and Provider Portals. Successful exploitation of this issue may allow a malicious actor to access the Tenant or Provider Portals by impersonating a currently logged in session.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/152289/VMware-Security-Advisory-2019-0004.html Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/107638 Third Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2019-0004.html Vendor Advisory
http://packetstormsecurity.com/files/152289/VMware-Security-Advisory-2019-0004.html Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/107638 Third Party AdvisoryVDB Entry
https://www.vmware.com/security/advisories/VMSA-2019-0004.html Vendor Advisory

Track CVE-2019-5523 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2020-3956Vmware vcloud director expression language injection vulnerabilityVMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input…EPSS 21%7.6CVE-2016-2076Vmware vcenter server improper authentication vulnerabilityClient Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Iden…EPSS 1.4%7.2CVE-2022-22966Vmware vcloud director vulnerabilityAn authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote…EPSS 6.6%6.8CVE-2014-1211Vmware vcloud director cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in VMware vCloud Director 5.1.x before 5.1.3 allows remote attackers to hijack the authentication of …EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2019-5523), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.