PT-2017-6820 · Pivotal+1 · Pivotal Cloud Foundry (Pcf) Elastic Runtime+2

Publicado 2016-05-02 · Atualizado 2022-05-13 · CVE-2015-5170

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cloud Foundry Runtime versions prior to 216 UAA versions prior to 2.5.2 Pivotal Cloud Foundry (PCF) Elastic Runtime versions prior to 1.7.0

Description The issue allows remote attackers to conduct cross-site request forgery (CSRF) attacks, potentially logging a user into an arbitrary account by leveraging the lack of CSRF checks. Additionally, it may have an unspecified impact due to the failure to expire password reset links and existing sessions.

Recommendations For Cloud Foundry Runtime versions prior to 216, update to version 216 or later to resolve the issue. For UAA versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. For Pivotal Cloud Foundry (PCF) Elastic Runtime versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue.

Correção

Insufficient Session Expiration

CSRF

Enumeração de Fraquezas

CWE-640

CWE-613

CWE-352

Identificadores relacionados

BDU:2018-00144

BDU:2018-00145

CVE-2015-5170

GHSA-CQ6M-74R4-X77G

GHSA-H533-Q6JC-QX28

GHSA-MPV3-G527-FQRJ

Produtos afetados

Cloud Foundry Runtime

Pivotal Cloud Foundry (Pcf) Elastic Runtime

Uaa

Referências · 17

• https://github.com/cloudfoundry/uaa · Nota
• https://github.com/cloudfoundry/uaa/commit/bdb1a39a1e72f615f2e7a429a896a11e7ee5ec17 · Nota
• https://github.com/cloudfoundry/uaa/commit/a54f3fb8225ef7d5021ca7d4fb52bef1e884568e · Nota
• https://github.com/cloudfoundry/uaa/commit/cd31cc397fe17389d95b83d6a9caa46eebc54faf · Nota
• https://github.com/cloudfoundry/uaa/commit/41dba9d81dbdf24ede4fb9719de28b1b88b3e1b4 · Nota
• https://github.com/cloudfoundry/uaa/commit/9730cd6a3bbb481ee4e400b51952b537589c469d · Nota
• https://github.com/cloudfoundry/uaa/commit/7c70a85f4c7b5a9b1603bc57cab14a7ffef2168b · Nota
• https://pivotal.io/security/cve-2015-5170-5173 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-cq6m-74r4-x77g · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00144 · Nota de Segurança
• http://securityfocus.com/bid/101579 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5172 · Nota de Segurança
• https://bdu.fstec.ru/vul/2018-00145 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-5170 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h533-q6jc-qx28 · Aviso do Fabricante