CVE-2015-3191

high

Published 2017-05-25 · Modified 2026-05-13

CVSS v3

8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2

6.8

VIR risk

8.8

Description

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Predictions

Exploit likelihood

92%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security_alert@emc.com — https://pivotal.io/security/cve-2015-3191

Application impact

Vendor	Product	Versions
cloudfoundry	cf-release	`{"endIncluding":"209"}`
pivotal_software	cloud_foundry_elastic_runtime	`{"endIncluding":"1.4.5"}`
pivotal_software	cloud_foundry_uaa	`{"endIncluding":"2.2.6"}`

References

CWEs

CWE-352

Verify integrity in audit chain (admin only). AS-IS.