CVE-2015-5170: CSRF
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5170?
CVE-2015-5170 has a medium severity rating due to its potential for cross-site request forgery attacks.
How do I fix CVE-2015-5170?
To fix CVE-2015-5170, upgrade Cloud Foundry Runtime to version 216 or higher, UAA to version 2.5.2 or higher, and Pivotal Cloud Foundry Elastic Runtime to version 1.7.0 or higher.
What versions are affected by CVE-2015-5170?
CVE-2015-5170 affects Cloud Foundry Runtime versions prior to 216, UAA versions prior to 2.5.2, and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.7.0.
What type of attacks does CVE-2015-5170 allow?
CVE-2015-5170 allows remote attackers to conduct cross-site request forgery (CSRF) attacks.
Is user data at risk with CVE-2015-5170?
Yes, CVE-2015-5170 poses a risk to user data as attackers can log a user into an arbitrary account.