The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
| CVE | CVE-2015-5171 |
|---|---|
| Severidad | CRITICAL |
| CVSS | 9.8 / 10 |
| EPSS | 1.2% en 30 días (percentil 66) |
| CWE | CWE-613 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Productos afectados (catálogo NVD)
cloudfoundry/cf-releasepivotal_software/cloud_foundry_elastic_runtimepivotal_software/cloud_foundry_uaa