CVE-2015-3191: cloudfoundry cf-release Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2015-3191 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in cloudfoundry cf-release. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities.

Timeline

1. 25-05-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.