CVE-2015-3189

Опубликовано: 25 мая 2017

Источник: nvd

CVSS3: 3.7

CVSS2: 4.3

EPSS Низкий

Описание

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Ссылки

https://pivotal.io/security/cve-2015-3189
Vendor Advisory
https://pivotal.io/security/cve-2015-3189
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*

Версия до 208 (включая)

cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*

Версия до 1.4.5 (включая)

cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*

Версия до 2.2.5 (включая)

EPSS

Процентиль: 39%

0.00178

Низкий

3.7 Low

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-640

Связанные уязвимости

GHSA-fj69-p8f6-q97h