CVE-2019-5533 json
In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enter…
published 2019-10-28 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15108
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.4%
- EPSS 17.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail address if present but no other personal data. VMware has evaluated the severity of this issue to be in the moderate severity range with a maximum CVSSv3 base score of 4.3.
Patch / fix
- vmware sd-wan_by_velocloud 3.3.0
Exploit prediction
17.39% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- VMware SD-WAN by VeloCloud
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
vmware.com
/security/advisories/VMSA-2019-0017.html
vendor-advisory
Sources
- CVE List CVE-2019-5533
- NVD CVE-2019-5533
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.