CVE-2015-3191

Published: May 25, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected (3)

Products: Cloudfoundry: Cf Release · Pivotal Software: Cloud Foundry Elastic Runtime, Cloud Foundry Uaa

1 product

Pivotal Software

2 products

Cloud Foundry Elastic Runtime

Cloud Foundry Uaa

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cloudfoundry Cf Release	Up to 209
Pivotal Software Cloud Foundry Elastic Runtime	Up to 1.4.5
Pivotal Software Cloud Foundry Uaa	Up to 2.2.6

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://pivotal.io/security/cve-2015-3191

Source: security_alert@emc.com

Vendor Advisory

https://pivotal.io/security/cve-2015-3191

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.