PT-2016-3243 · Pivotal+1 · Pivotal Cloud Foundry (Pcf) Elastic Runtime+2

Publicado 2016-05-02 · Atualizado 2022-05-13 · CVE-2015-5171

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions prior to 216 UAA versions prior to 2.5.2 Pivotal Cloud Foundry (PCF) Elastic Runtime versions prior to 1.7.0

Description The issue is related to the password change functionality, where failure to expire existing sessions can be leveraged by attackers. This allows a remote attacker to exploit an old session after a password reset, as logging in with a new password does not invalidate already established sessions.

Recommendations For Cloud Foundry Runtime cf-release versions prior to 216, update to version 216 or later. For UAA versions prior to 2.5.2, update to version 2.5.2 or later. For Pivotal Cloud Foundry (PCF) Elastic Runtime versions prior to 1.7.0, update to version 1.7.0 or later.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

BDU:2018-00145

CVE-2015-5171

GHSA-H533-Q6JC-QX28

Produtos afetados

Cloud Foundry Runtime

Pivotal Cloud Foundry (Pcf) Elastic Runtime

Uaa

Referências · 7

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/commit/9730cd6a3bbb481ee4e400b51952b537589c469d · Nota
• https://github.com/cloudfoundry/uaa/commit/7c70a85f4c7b5a9b1603bc57cab14a7ffef2168b · Nota
• https://pivotal.io/security/cve-2015-5170-5173 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5171 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h533-q6jc-qx28 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00145 · Nota de Segurança