Description
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.
Remediation
References
https://pivotal.io/security/cve-2015-3190
Related Vulnerabilities
CVE-2006-1547 Vulnerability in maven package struts:struts
CVE-2012-0394 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2017-1000404 Vulnerability in maven package se.diabol.jenkins.pipeline:delivery-pipeline-plugin
CVE-2014-0110 Vulnerability in maven package org.apache.cxf:cxf-bundle
CVE-2010-1330 Vulnerability in maven package org.jruby:jruby