What’s Vulnerable › Vulnerabilities
CVE-2015-3189
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-05-25 · updated 2026-06-17
- Weakness: CWE-640
Description
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Affected products
- Cloud Foundry Cloud Controller cf-release versions prior to v255: through 208
- PCF Elastic Runtime: through 1.4.5
- Cloud Foundry UAA: through 2.2.5
References
Get alerted when CVE-2015-3189 or the next vulnerability affects your stack