GHSA-cq6m-74r4-x77g

ghsaUSosv

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

view advisory published 2022-05-13Licence: CC-BY-4.0

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-5172US	critical9.8	1.17% (67th)	—	2017-10-24
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging…

references

External citations — patches, advisories, analysis.

https://github.com/cloudfoundry/uaaPACKAGE
https://github.com/cloudfoundry/uaa/commit/cd31cc397fe17389d95b83d6a9caa46eebc54fafWEB
https://nvd.nist.gov/vuln/detail/CVE-2015-5172ADVISORY
https://pivotal.io/security/cve-2015-5170-5173WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan