PT-2017-6641 · Cloud Foundry+1 · Cloud Foundry Runtime+2

Publicado 2017-05-25 · Atualizado 2022-05-13 · CVE-2015-3189

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime cf-release versions v208 or earlier UAA Standalone versions 2.2.5 or earlier Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier

Description The issue arises when a user changes their email address, and old password reset links are not expired. This is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Recommendations For Cloud Foundry Runtime cf-release versions v208 or earlier, update to a version later than v208 to resolve the issue. For UAA Standalone versions 2.2.5 or earlier, update to a version later than 2.2.5 to resolve the issue. For Pivotal Cloud Foundry Runtime versions 1.4.5 or earlier, update to a version later than 1.4.5 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2015-3189

GHSA-FJ69-P8F6-Q97H

Produtos afetados

Cloud Foundry Runtime

Pivotal Cloud Foundry Runtime

Uaa

Referências · 8

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/compare/2.2.5...2.2.6 · Nota
• https://github.com/cloudfoundry/uaa/commits/2.2.5 · Nota
• https://github.com/cloudfoundry/uaa/commit/a79b89f6e4f66626914b029b7a15a423491f8013 · Nota
• https://github.com/cloudfoundry/uaa/compare/2.2.4...2.2.5 · Nota
• https://pivotal.io/security/cve-2015-3189 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3189 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-fj69-p8f6-q97h · Aviso do Fabricante