CRITICAL🇵🇱 Wersja polska

CVE-2015-5172

CVSS 9.8v3.1pub. 2017-10-24upd. 2026-05-13

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Cloudfoundry Cf Release

    APP
    Cloudfoundry
    < 216

  • Pivotal Software Cloud Foundry Elastic Runtime

    APP
    Pivotal Software
    < 1.7.0

  • Pivotal Software Cloud Foundry Uaa

    APP
    Pivotal Software
    < 2.5.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2018-15761CRITICAL9.9PL ✓same product

Privilege escalation w Cloud Foundry UAA poprzez manipulację stroną zgody

CVE-2016-6658CRITICAL9.6PL ✓same product

Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2016-6655CRITICAL9.8PL ✓same product

Command injection w skryptach Cloud Foundry i cf-mysql-release

CVE-2016-8218CRITICAL9.8PL ✓same product

Cloud Foundry: Podszywanie się pod użytkowników przez błąd walidacji JWT