CVE-2019-11292— Pivotal Ops Manager logs query parameters in tomcat access file
Quick assessment
Affected
Pivotal Pivotal Ops Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pivotal Software Ops Manager是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。该平台能够提供容器调度、持续交付和自动化服务部署等功能。 Pivotal Software Ops Manager中存在日志信息泄露漏洞。该漏洞源于网络系统或产品的日志文件非正常输出。以下产品及版本受到影响：Pivotal Software Ops Manager 2.4.27之前的2.4.x版本，2.5.24之前的2.5.x版本，2.6.16之前的2.6.x版本
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-11292
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pivotal Ops Manager logs query parameters in tomcat access file
Source: CVE Program / CVE List V5
Vulnerability Description
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Pivotal Software Ops Manager 日志信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pivotal Software Ops Manager是美国Pivotal Software公司的一套开源的平台即服务（PaaS）云计算平台。该平台能够提供容器调度、持续交付和自动化服务部署等功能。 Pivotal Software Ops Manager中存在日志信息泄露漏洞。该漏洞源于网络系统或产品的日志文件非正常输出。以下产品及版本受到影响：Pivotal Software Ops Manager 2.4.27之前的2.4.x版本，2.5.24之前的2.5.x版本，2.6.16之前的2.6.x版本
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Pivotal | Pivotal Ops Manager | 2.7 ~ 2.7.5 | - |
|
II. Public POCs for CVE-2019-11292
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-11292
请登录查看更多情报信息。
Other References for CVE-2019-11292 (1)
-
https://pivotal.io/security/cve-2019-11292 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: Pivotal
-
CVE-2020-5409
Concourse Open Redirect in the /sky/login endpoint -
CVE-2020-5406
PCF Autoscaling logs its database credentials -
CVE-2020-5403
DoS Via Malformed URL with Reactor Netty HTTP Server -
CVE-2020-5404
Authentication Leak On Redirect With Reactor Netty HttpClien -
CVE-2019-11288
tcServer JMX Socket Listener Registry Rebinding Local Privil
Same weakness: CWE-532
-
CVE-2026-115885
LangGraph CLI prints the registry push token in `langgraph d -
CVE-2026-54711
PGHoard: Password written to debug log -
CVE-2026-105963
Secret key base exposed in stack trace arguments on wrong-ty -
CVE-2026-115657
KNIME Analytics Platform logs credentials of configured prox -
CVE-2026-115358
OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Ma
V. Comments for CVE-2019-11292
No comments yet