CRITICAL🇵🇱 Wersja polska

CVE-2015-5171

CVSS 9.8v3.1pub. 2017-10-24upd. 2026-05-13

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cloudfoundry Cf Release

    APP
    Cloudfoundry
    < 216

  • Pivotal Software Cloud Foundry Elastic Runtime

    APP
    Pivotal Software
    < 1.7.0

  • Pivotal Software Cloud Foundry Uaa

    APP
    Pivotal Software
    < 2.5.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-15761CRITICAL9.9PL ✓same product

Privilege escalation w Cloud Foundry UAA poprzez manipulację stroną zgody

CVE-2016-6658CRITICAL9.6PL ✓same product

Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła

CVE-2016-6655CRITICAL9.8PL ✓same product

Command injection w skryptach Cloud Foundry i cf-mysql-release

CVE-2016-8218CRITICAL9.8PL ✓same product

Cloud Foundry: Podszywanie się pod użytkowników przez błąd walidacji JWT