CVE-2015-3189

Published: May 25, 2017Modified: May 13, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected (3)

Products: Cloudfoundry: Cf Release · Pivotal Software: Cloud Foundry Elastic Runtime, Cloud Foundry Uaa

1 product

Pivotal Software

2 products

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cf Release	Up to 208
Pivotal Software Cloud Foundry Elastic Runtime	Up to 1.4.5
Pivotal Software Cloud Foundry Uaa	Up to 2.2.5

Related CWEs

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://pivotal.io/security/cve-2015-3189

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2015-3189

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.