CVE-2015-3190

Published: May 25, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.

Affected (3)

Products: Cloudfoundry: Cf Release · Pivotal Software: Cloud Foundry Elastic Runtime, Cloud Foundry Uaa

1 product

Pivotal Software

2 products

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cf Release	Up to 209
Pivotal Software Cloud Foundry Elastic Runtime	Up to 1.4.5
Pivotal Software Cloud Foundry Uaa	Up to 2.2.6

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://pivotal.io/security/cve-2015-3190

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2015-3190

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.