Critical severity9.8NVD Advisory· Published Oct 24, 2017· Updated Jun 17, 2026

CVE-2015-5172

Description

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.cloudfoundry.identity:cloudfoundry-identity-serverMaven	< 2.5.2	2.5.2

Affected products

Cloudfoundry/Cf Release
cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*
Range: <216
Cloudfoundry/Elastic Runtime
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*
Range: <1.7.0
Cloudfoundry/Uaa
cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*
Range: <2.5.2
ghsa-coords
pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Range: < 2.5.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-cq6m-74r4-x77gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2015-5172ghsaADVISORY
pivotal.io/security/cve-2015-5170-5173nvdVendor AdvisoryWEB
github.com/cloudfoundry/uaa/commit/cd31cc397fe17389d95b83d6a9caa46eebc54fafghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000