9.8
CVE-2015-5171
- EPSS 0.49%
- Published 24.10.2017 17:29:00
- Last modified 20.04.2025 01:37:25
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
Data is provided by the National Vulnerability Database (NVD)
Cloudfoundry ≫ Cf-release Version < 216
Pivotal Software ≫ Cloud Foundry Elastic Runtime Version < 1.7.0
Pivotal Software ≫ Cloud Foundry Uaa Version < 2.5.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.49% | 0.643 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-613 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."