CVE-2015-5170 Cloud Foundry Runtime Cross-Site Request Forgery vulnerability

What is CVE-2015-5170?

CVE-2015-5170 is a high-severity vulnerability in n/a, published on 24 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.

Weakness: CWE-352

Which versions are affected by CVE-2015-5170?

2 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Release, Pivotal Software Cloud Foundry Elastic Runtime, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2015-5170?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 2.5.2 or later.

Is CVE-2015-5170 being exploited?

There is no known exploitation of CVE-2015-5170 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability Critical 9.8
• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mpv3-g527-fqrj.