CVE-2015-5170
HighSummary
Cloud Foundry Runtime versions before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS, enabling them to log a user into an arbitrary account due to a lack of CSRF checks.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized access to user accounts, potentially leading to data theft or other malicious activities.
Recommendation
It is recommended to upgrade to the latest versions of Cloud Foundry Runtime, UAA, and Pivotal Cloud Foundry to patch this vulnerability and implement appropriate CSRF validation mechanisms.
Other vulnerabilities in Cloud Foundry Runtime, UAA, Pivotal Cloud Foundry Elastic Runtime
See all- CVE-2015-5173High
Cloud Foundry Runtime before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via emails with password recovery links, known as 'Cross Domain Referer Leakage.'
- CVE-2015-5172Critical
Cloud Foundry Runtime before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to leverage unspecified impact by failing to expire password reset links.
- CVE-2015-5171Critical
The password change functionality in Cloud Foundry Runtime before version 216, UAA before version 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before version 1.7.0 allows attackers to leverage the failure to expire existing sessions.
Original NVD description (English source)
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.