CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability

What is CVE-2015-5171?

CVE-2015-5171 is a critical vulnerability in n/a, published on 24 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

Weakness: CWE-613

Which versions are affected by CVE-2015-5171?

2 open source packages ship an affected version, including org.cloudfoundry.identity:cloudfoundry-identity-server. It affects 3 products.

Products include Cloudfoundry Cf-Release, Pivotal Software Cloud Foundry Elastic Runtime, Pivotal Software Cloud Foundry Uaa.

How do I fix CVE-2015-5171?

Upgrade org.cloudfoundry.identity:cloudfoundry-identity-server to 2.5.2 or later.

Is CVE-2015-5171 being exploited?

There is no known exploitation of CVE-2015-5171 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password Critical 9.8
• CVE-2016-8218 Auth bypass in Cloud Foundry Critical 9.8
• CVE-2017-4992 Cloud Foundry UAA privilege escalation with user invitations Critical 9.8
• CVE-2016-6658 Information disclosure in n/a Critical 9.6
• CVE-2015-5170 Cloud Foundry Runtime Cross-Site Request Forgery vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h533-q6jc-qx28.