Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tcHYzLWc1MjctZnFyas3tng

Cloud Foundry Runtime Cross-Site Request Forgery vulnerability

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.

Permalink: https://github.com/advisories/GHSA-mpv3-g527-fqrj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcHYzLWc1MjctZnFyas3tng
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: 2 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-mpv3-g527-fqrj, CVE-2015-5170
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-5170
• https://pivotal.io/security/cve-2015-5170-5173
• http://www.securityfocus.com/bid/101579
• https://github.com/cloudfoundry/uaa/commit/41dba9d81dbdf24ede4fb9719de28b1b88b3e1b4
• https://github.com/cloudfoundry/uaa/commit/a54f3fb8225ef7d5021ca7d4fb52bef1e884568e
• https://github.com/cloudfoundry/uaa/commit/bdb1a39a1e72f615f2e7a429a896a11e7ee5ec17
• https://github.com/advisories/GHSA-mpv3-g527-fqrj

Repository: https://github.com/cloudfoundry/uaa
Blast Radius: 10.3

Affected Packages