CVE-2015-5170: CSRF
First published: Tue Oct 24 2017(Updated: )
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.cloudfoundry.identity:cloudfoundry-identity-server | <2.5.2 | 2.5.2 |
| Cloud Foundry CF Release | <216 | |
| Pivotal Cloud Foundry Elastic Runtime | <1.7.0 | |
| Cloud Foundry User Account and Authentication (UAA) | <2.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/101579
- https://pivotal.io/security/cve-2015-5170-5173
- https://nvd.nist.gov/vuln/detail/CVE-2015-5170
- https://github.com/cloudfoundry/uaa/commit/41dba9d81dbdf24ede4fb9719de28b1b88b3e1b4
- https://github.com/cloudfoundry/uaa/commit/a54f3fb8225ef7d5021ca7d4fb52bef1e884568e
- https://github.com/cloudfoundry/uaa/commit/bdb1a39a1e72f615f2e7a429a896a11e7ee5ec17
- https://github.com/advisories/GHSA-mpv3-g527-fqrj (Advisory)
Frequently Asked Questions
What is the severity of CVE-2015-5170?
CVE-2015-5170 has a medium severity rating due to its potential for cross-site request forgery attacks.
How do I fix CVE-2015-5170?
To fix CVE-2015-5170, upgrade Cloud Foundry Runtime to version 216 or higher, UAA to version 2.5.2 or higher, and Pivotal Cloud Foundry Elastic Runtime to version 1.7.0 or higher.
What versions are affected by CVE-2015-5170?
CVE-2015-5170 affects Cloud Foundry Runtime versions prior to 216, UAA versions prior to 2.5.2, and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.7.0.
What type of attacks does CVE-2015-5170 allow?
CVE-2015-5170 allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
Is user data at risk with CVE-2015-5170?
Yes, CVE-2015-5170 poses a risk to user data as attackers can log a user into an arbitrary account.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mpv3-g527-fqrj
- alias/CVE-2015-5170
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/maven
- vendor/cloudfoundry
- canonical/cloud foundry cf release
- vendor/pivotal software
- canonical/pivotal cloud foundry elastic runtime
- canonical/cloud foundry user account and authentication (uaa)