CVE-2019-11242

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cohesity/SecAdvisory/blob/master/README.mdThird Party Advisory
https://github.com/cohesity/SecAdvisory/blob/master/README.mdThird Party Advisory

Timeline

Published: Jul 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-112438.1In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials r CVE-2019-112445.0In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cach CVE-2019-112457.8In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container re CVE-2019-112466.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar ins CVE-2019-112478.1The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were na CVE-2019-112488.2The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kube CVE-2019-112496.5The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar ins CVE-2019-11255.6An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who succ CVE-2019-112506.5The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized user CVE-2019-112515.7The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlin CVE-2019-112526.5The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs CVE-2019-112537.5Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 a