CVE-2015-5170
High
Description
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCloudfoundry Cf-release
PublishedOct 24, 2017
First seenOct 24, 2017
How to fix
Update
- cloudfoundry cf-release216 or later
- pivotal_software cloud_foundry_elastic_runtime1.7.0 or later
- pivotal_software cloud_foundry_uaa2.5.2 or later
- org.cloudfoundry.identity:cloudfoundry-identity-server2.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-release | v < 216 | 216 |
| pivotal_software cloud_foundry_elastic_runtime | v < 1.7.0 | 1.7.0 |
| pivotal_software cloud_foundry_uaa | v < 2.5.2 | 2.5.2 |
| org.cloudfoundry.identity:cloudfoundry-identity-serverMaven | v < 2.5.2 | 2.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.