Description

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

Remediation

References

https://pivotal.io/security/cve-2015-5170-5173

Related Vulnerabilities

CVE-2012-5636 Vulnerability in maven package org.apache.wicket:wicket

CVE-2020-2128 Vulnerability in maven package com.catalogic.ecxjenkins:catalogic-ecx

CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

CVE-2023-24448 Vulnerability in maven package org.jenkins-ci.plugins:rabbitmq-consumer

CVE-2019-16303 Vulnerability in npm package generator-jhipster

Severity

Critical

Classification

CWE-613 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory