CVE-2015-5171
Critical
Description
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
SeverityCritical
CVSS9.8
Exploit probability—
ProductCloudfoundry Cf-release
PublishedOct 24, 2017
First seenOct 24, 2017
How to fix
Update
- cloudfoundry cf-release216 or later
- pivotal_software cloud_foundry_elastic_runtime1.7.0 or later
- pivotal_software cloud_foundry_uaa2.5.2 or later
- org.cloudfoundry.identity:cloudfoundry-identity-server2.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cloudfoundry cf-release | v < 216 | 216 |
| pivotal_software cloud_foundry_elastic_runtime | v < 1.7.0 | 1.7.0 |
| pivotal_software cloud_foundry_uaa | v < 2.5.2 | 2.5.2 |
| org.cloudfoundry.identity:cloudfoundry-identity-serverMaven | v < 2.5.2 | 2.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.