CVE-2015-3191

Name: CVE-2015-3191
Creator: NVD / NIST
Published: 2017-05-25T17:29:00.41+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 0.49%

Last modified Jun 17, 2026

CVE-2015-3191 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. EPSS estimates a 0.49% chance of exploitation in the next 30 days.

Description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

0.49%

38.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-352

Affected Software

Vendor	Product	Versions
Cloudfoundry	Cf-Release	<= 209
Pivotal Software	Cloud Foundry Elastic Runtime	<= 1.4.5
Pivotal Software	Cloud Foundry Uaa	<= 2.2.6

References

https://pivotal.io/security/cve-2015-3191Vendor Advisory
https://pivotal.io/security/cve-2015-3191Vendor Advisory

Timeline

Published: May 25, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-3191?

How severe is CVE-2015-3191?

CVE-2015-3191 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.49% probability of exploitation in the next 30 days.

How do I fix CVE-2015-3191?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-3191?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST