GHSA-cq6m-74r4-x77g

Source

https://github.com/advisories/GHSA-cq6m-74r4-x77g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cq6m-74r4-x77g/GHSA-cq6m-74r4-x77g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cq6m-74r4-x77g

Aliases

CVE-2015-5172

Published

2022-05-13T01:07:00Z

Modified

2024-02-28T21:28:31Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

Details

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

Database specific

{
    "cwe_ids": [
        "CWE-640"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-28T21:03:01Z",
    "nvd_published_at": "2017-10-24T17:29:00Z",
    "severity": "CRITICAL"
}

References

Affected packages

Maven / org.cloudfoundry.identity:cloudfoundry-identity-server

Package

Name: org.cloudfoundry.identity:cloudfoundry-identity-server; View open source insights on deps.dev
Purl: pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cq6m-74r4-x77g/GHSA-cq6m-74r4-x77g.json"