CVE-2015-3190

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security_alert@emc.com

Published

2017-05-25

Last modified

2024-08-06

Weaknesses

CWE-601

Affected products

• Cf-release (Cloudfoundry)
• Cloud Foundry (Pivotal)
• Cloud Foundry Elastic Runtime (Pivotal Software)
• Cloud Foundry Uaa (Pivotal Software)

References

• https://pivotal.io/security/cve-2015-3190