Low severity3.7NVD Advisory· Published May 25, 2017· Updated Jun 17, 2026
CVE-2015-3189
CVE-2015-3189
Description
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.cloudfoundry.identity:cloudfoundry-identity-serverMaven | < 2.2.5 | 2.2.5 |
Affected products
5- cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*Range: <=1.4.5
- Range: Runtime cf-release versions v208 or earlier
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-fj69-p8f6-q97hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2015-3189ghsaADVISORY
- pivotal.io/security/cve-2015-3189nvdVendor AdvisoryWEB
- github.com/cloudfoundry/uaa/commit/a79b89f6e4f66626914b029b7a15a423491f8013ghsaWEB
- github.com/cloudfoundry/uaa/commits/2.2.5ghsaWEB
- github.com/cloudfoundry/uaa/compare/2.2.4...2.2.5ghsaWEB
- github.com/cloudfoundry/uaa/compare/2.2.5...2.2.6ghsaWEB
News mentions
0No linked articles in our index yet.