CVE-2015-3191 Cross-site request forgery in Cloud Foundry

High 8.8 Published 25 May 2017 Updated 6 Aug 2024

An attacker can force a logged-in user to change their email address via a malicious link, potentially leading to account takeover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2015-3191?

CVE-2015-3191 is a high-severity vulnerability in Pivotal Cloud Foundry, published on 25 May 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Weakness: CWE-352

Which versions are affected by CVE-2015-3191?

It affects 3 products.

Products include Cloudfoundry Cf-Release, Pivotal Software Cloud Foundry Elastic Runtime, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2015-3191?

No fix has been published for CVE-2015-3191 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-3191 being exploited?

There is no known exploitation of CVE-2015-3191 in the wild and no public exploit code.

Sources

Also known as GHSA-442q-44xh-2275.