Lucene search

[email protected]CVE-2015-5171

HistoryOct 24, 2017 - 5:29 p.m.

CVE-2015-5171

2017-10-2417:29:00

CWE-613

[email protected]

web.nvd.nist.gov

cve-2015-5171

cloud foundry

cf-release

uaa

pivotal cloud foundry

pcf elastic runtime

password change

session expiration

security vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.7%

JSON

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

Affected configurations

NVD

Node

cloudfoundrycf-releaseRange<216

pivotal_softwarecloud_foundry_elastic_runtimeRange<1.7.0

pivotal_softwarecloud_foundry_uaaRange<2.5.2

CPENameOperatorVersion
cloudfoundry:cf-releasecloudfoundry cf-releaselt216
pivotal_software:cloud_foundry_elastic_runtimepivotal software cloud foundry elastic runtimelt1.7.0
pivotal_software:cloud_foundry_uaapivotal software cloud foundry uaalt2.5.2

CPE	Name	Operator	Version
cloudfoundry:cf-release	cloudfoundry cf-release	lt	216
pivotal_software:cloud_foundry_elastic_runtime	pivotal software cloud foundry elastic runtime	lt	1.7.0
pivotal_software:cloud_foundry_uaa	pivotal software cloud foundry uaa	lt	2.5.2

References

pivotal.io/security/cve-2015-5170-5173

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.7%

JSON

Related for CVE-2015-5171

cvelist1 github1 nvd1 prion1 osv1 cloudfoundry1