CVE-2015-3191: CSRF
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the changeemail form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3191?
CVE-2015-3191 is classified as a medium severity vulnerability that exposes users to potential CSRF attacks.
How do I fix CVE-2015-3191?
To fix CVE-2015-3191, upgrade to Cloud Foundry Runtime cf-release versions later than v209, UAA Standalone versions later than 2.2.6, or Pivotal Cloud Foundry Runtime versions later than 1.4.5.
What systems are affected by CVE-2015-3191?
CVE-2015-3191 affects Cloud Foundry cf-release versions v209 and earlier, Pivotal Cloud Foundry Elastic Runtime v1.4.5 and earlier, and UAA Standalone versions 2.2.6 and earlier.
What type of attack does CVE-2015-3191 enable?
CVE-2015-3191 enables Cross-Site Request Forgery (CSRF) attacks, allowing attackers to trigger unauthorized actions on behalf of logged-in users.
What are the implications of CVE-2015-3191 for users?
The implications of CVE-2015-3191 for users include the potential unauthorized change of email addresses and access to sensitive account information.