CVE-2015-5171

CRITICAL9.8EPSS 0.48%

Cloud Foundry Runtime Insufficient Session Expiration vulnerability

Published: 5/13/2022Modified: 2/28/2024

Description

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

Affected packages (1)

Maven/org.cloudfoundry.identity:cloudfoundry-identity-serverfrom 0, < 2.5.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2015-5171
PATCHhttps://github.com/cloudfoundry/uaa
WEBhttps://github.com/cloudfoundry/uaa/commit/7c70a85f4c7b5a9b1603bc57cab14a7ffef2168b
WEBhttps://github.com/cloudfoundry/uaa/commit/9730cd6a3bbb481ee4e400b51952b537589c469d
WEBhttps://pivotal.io/security/cve-2015-5170-5173