Vulnerability CVE-2015-3189
Published: 2017-05-25

Description:
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Pivotal software -> Cloud foundry elastic runtime cf release 
Pivotal software -> Cloud foundry uaa 
Pivotal software -> Cloud foundry elastic runtime 

 References:
https://pivotal.io/security/cve-2015-3189
Copyright 2024, cxsecurity.com

 

Back to Top