Lucene search

[email protected]CVE-2015-5170

HistoryOct 24, 2017 - 5:29 p.m.

CVE-2015-5170

2017-10-2417:29:00

CWE-352

[email protected]

web.nvd.nist.gov

cve-2015-5170

cloud foundry

runtime

cf-release

uaa

pivotal cloud foundry

pcf

elastic runtime

csrf

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.1%

JSON

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.

Affected configurations

NVD

Node

cloudfoundrycf-releaseRange<216

pivotal_softwarecloud_foundry_elastic_runtimeRange<1.7.0

pivotal_softwarecloud_foundry_uaaRange<2.5.2

CPENameOperatorVersion
cloudfoundry:cf-releasecloudfoundry cf-releaselt216
pivotal_software:cloud_foundry_elastic_runtimepivotal software cloud foundry elastic runtimelt1.7.0
pivotal_software:cloud_foundry_uaapivotal software cloud foundry uaalt2.5.2

CPE	Name	Operator	Version
cloudfoundry:cf-release	cloudfoundry cf-release	lt	216
pivotal_software:cloud_foundry_elastic_runtime	pivotal software cloud foundry elastic runtime	lt	1.7.0
pivotal_software:cloud_foundry_uaa	pivotal software cloud foundry uaa	lt	2.5.2

References

www.securityfocus.com/bid/101579

pivotal.io/security/cve-2015-5170-5173

Social References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.1%

JSON

Related for CVE-2015-5170

osv3 nvd1 cvelist1 prion1 github1 cloudfoundry1