CVE-2015-3189 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

What is CVE-2015-3189?

CVE-2015-3189 is a low-severity vulnerability in Pivotal Cloud Foundry, published on 25 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Weakness: CWE-640

Which versions are affected by CVE-2015-3189?

2 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Release, Pivotal Software Cloud Foundry Elastic Runtime, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2015-3189?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 2.2.5 or later.

Is CVE-2015-3189 being exploited?

There is no known exploitation of CVE-2015-3189 in the wild and no public exploit code.

Other vulnerabilities in Pivotal Cloud Foundry

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fj69-p8f6-q97h.