CVE-2015-5171: Critical severity Cloudfoundry Cf-release vulnerability
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5171?
CVE-2015-5171 is classified as a moderate severity vulnerability.
How do I fix CVE-2015-5171?
To fix CVE-2015-5171, update Cloud Foundry Runtime to cf-release version 216 or higher, UAA to version 2.5.2 or higher, or Pivotal Cloud Foundry Elastic Runtime to version 1.7.0 or higher.
What systems are affected by CVE-2015-5171?
CVE-2015-5171 affects Cloud Foundry Runtime cf-release versions before 216, UAA versions before 2.5.2, and Pivotal Cloud Foundry Elastic Runtime versions before 1.7.0.
What impact does CVE-2015-5171 have?
Mitigation of CVE-2015-5171 requires ensuring all components are updated and reviewing session management policies.