CVE-2015-3191
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
En Cloud Foundry Runtime versiones v209 y anteriores, UAA Standalone versiones 2.2.6 o anteriores y Pivotal Cloud Foundry Runtime, versiones 1.4.5 o anteriores, el formulario change_email en UAA es vulnerable a un ataque de tipo CSFR. Esto permitiría a un atacante activar un cambio de e-mail para un usuario logado en una instancia de Cloud Foundry a través de un link malicioso en un site controlado por el atacante. Despliegues habilitados para la integración a través de SAML o LDAP no estarían afectados.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-04-10 CVE Reserved
- 2017-05-25 CVE Published
- 2024-02-05 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://pivotal.io/security/cve-2015-3191 | 2021-08-25 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cloudfoundry Search vendor "Cloudfoundry" | Cf-release Search vendor "Cloudfoundry" for product "Cf-release" | <= 209 Search vendor "Cloudfoundry" for product "Cf-release" and version " <= 209" | - |
Affected
| ||||||
Pivotal Software Search vendor "Pivotal Software" | Cloud Foundry Elastic Runtime Search vendor "Pivotal Software" for product "Cloud Foundry Elastic Runtime" | <= 1.4.5 Search vendor "Pivotal Software" for product "Cloud Foundry Elastic Runtime" and version " <= 1.4.5" | - |
Affected
| ||||||
Pivotal Software Search vendor "Pivotal Software" | Cloud Foundry Uaa Search vendor "Pivotal Software" for product "Cloud Foundry Uaa" | <= 2.2.6 Search vendor "Pivotal Software" for product "Cloud Foundry Uaa" and version " <= 2.2.6" | - |
Affected
|