What is GHSA-mpv3-g527-fqrj?

GHSA-mpv3-g527-fqrj is a security advisory published by GitHub Security Advisories with High severity. Cloud Foundry Runtime Cross-Site Request Forgery vulnerability

Which CVE IDs does GHSA-mpv3-g527-fqrj cover?

GHSA-mpv3-g527-fqrj covers the following CVE IDs: CVE-2015-5170. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mpv3-g527-fqrj?

GHSA-mpv3-g527-fqrj has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mpv3-g527-fqrj?

GHSA-mpv3-g527-fqrj affects 1 product, including: maven/org.cloudfoundry.identity:cloudfoundry-identity-server:\u003c 2.5.2.

GHSA-mpv3-g527-fqrjHighCVSS 8.8

Cloud Foundry Runtime Cross-Site Request Forgery vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

February 28, 2024

🔗 CVE IDs covered (1)

CVE-2015-5170 →

📋 Description

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.

🎯 Affected products1

maven/org.cloudfoundry.identity:cloudfoundry-identity-server:< 2.5.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2015-5170
https://pivotal.io/security/cve-2015-5170-5173
http://www.securityfocus.com/bid/101579
https://github.com/cloudfoundry/uaa/commit/41dba9d81dbdf24ede4fb9719de28b1b88b3e1b4
https://github.com/cloudfoundry/uaa/commit/a54f3fb8225ef7d5021ca7d4fb52bef1e884568e
https://github.com/cloudfoundry/uaa/commit/bdb1a39a1e72f615f2e7a429a896a11e7ee5ec17
https://github.com/advisories/GHSA-mpv3-g527-fqrj