Lucene search

[email protected]CVE-2015-5173

HistoryOct 24, 2017 - 5:29 p.m.

CVE-2015-5173

2017-10-2417:29:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2015-5173

cloud foundry

cf-release

uaa

pivotal cloud foundry

elastic runtime

cross domain referer leakage

email security

password recovery links

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka “Cross Domain Referer Leakage.”

Affected configurations

NVD

Node

cloudfoundrycf-releaseRange<216

pivotal_softwarecloud_foundry_elastic_runtimeRange<1.7.0

pivotal_softwarecloud_foundry_uaaRange<2.5.2

CPENameOperatorVersion
cloudfoundry:cf-releasecloudfoundry cf-releaselt216
pivotal_software:cloud_foundry_elastic_runtimepivotal software cloud foundry elastic runtimelt1.7.0
pivotal_software:cloud_foundry_uaapivotal software cloud foundry uaalt2.5.2

CPE	Name	Operator	Version
cloudfoundry:cf-release	cloudfoundry cf-release	lt	216
pivotal_software:cloud_foundry_elastic_runtime	pivotal software cloud foundry elastic runtime	lt	1.7.0
pivotal_software:cloud_foundry_uaa	pivotal software cloud foundry uaa	lt	2.5.2

References

pivotal.io/security/cve-2015-5170-5173

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.8%

JSON

Related for CVE-2015-5173

prion1 nvd1 cvelist1 cloudfoundry1