Critical severity9.8NVD Advisory· Published Oct 24, 2017· Updated Jun 17, 2026

CVE-2015-5171

Description

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.cloudfoundry.identity:cloudfoundry-identity-serverMaven	< 2.5.2	2.5.2

Affected products

Cloudfoundry/Cf Release
cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*
Range: <216
Cloudfoundry/Elastic Runtime
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*
Range: <1.7.0
Cloudfoundry/Uaa
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
Range: <2.5.2
ghsa-coords
pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Range: < 2.5.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-h533-q6jc-qx28ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2015-5171ghsaADVISORY
pivotal.io/security/cve-2015-5170-5173nvdVendor AdvisoryWEB
github.com/cloudfoundry/uaa/commit/7c70a85f4c7b5a9b1603bc57cab14a7ffef2168bghsaWEB
github.com/cloudfoundry/uaa/commit/9730cd6a3bbb481ee4e400b51952b537589c469dghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000