{"api_version":"1","generated_at":"2026-07-23T18:57:33+00:00","cve":"CVE-2015-3190","urls":{"html":"https://cve.report/CVE-2015-3190","api":"https://cve.report/api/cve/CVE-2015-3190.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3190","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3190"},"summary":{"title":"CVE-2015-3190","description":"With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.","state":"PUBLISHED","assigner":"dell","published_at":"2017-05-25 17:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-601","Open redirect"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://pivotal.io/security/cve-2015-3190","name":"https://pivotal.io/security/cve-2015-3190","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"CVE-2015-3190 - Open redirect on Login | Security | Pivotal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3190","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3190","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Pivotal","product":"Cloud Foundry","version":"affected Runtime cf-release versions v209 or earlier","platforms":[]},{"source":"CNA","vendor":"Pivotal","product":"Cloud Foundry","version":"affected UAA Standalone versions 2.2.6 or earlier","platforms":[]},{"source":"CNA","vendor":"Pivotal","product":"Cloud Foundry","version":"affected Runtime 1.4.5 or earlier","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3190","vulnerable":"1","versionEndIncluding":"209","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cloudfoundry","cpe5":"cf-release","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3190","vulnerable":"1","versionEndIncluding":"1.4.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pivotal_software","cpe5":"cloud_foundry_elastic_runtime","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"3190","vulnerable":"1","versionEndIncluding":"2.2.6","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pivotal_software","cpe5":"cloud_foundry_uaa","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:39:31.774Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://pivotal.io/security/cve-2015-3190"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Cloud Foundry","vendor":"Pivotal","versions":[{"status":"affected","version":"Runtime cf-release versions v209 or earlier"},{"status":"affected","version":"UAA Standalone versions 2.2.6 or earlier"},{"status":"affected","version":"Runtime 1.4.5 or earlier"}]}],"datePublic":"2015-06-25T00:00:00.000Z","descriptions":[{"lang":"en","value":"With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter."}],"problemTypes":[{"descriptions":[{"description":"Open redirect","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-05-25T16:57:01.000Z","orgId":"c550e75a-17ff-4988-97f0-544cde3820fe","shortName":"dell"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://pivotal.io/security/cve-2015-3190"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security_alert@emc.com","ID":"CVE-2015-3190","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cloud Foundry","version":{"version_data":[{"version_value":"Runtime cf-release versions v209 or earlier"},{"version_value":"UAA Standalone versions 2.2.6 or earlier"},{"version_value":"Runtime 1.4.5 or earlier"}]}}]},"vendor_name":"Pivotal"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Open redirect"}]}]},"references":{"reference_data":[{"name":"https://pivotal.io/security/cve-2015-3190","refsource":"CONFIRM","url":"https://pivotal.io/security/cve-2015-3190"}]}}}},"cveMetadata":{"assignerOrgId":"c550e75a-17ff-4988-97f0-544cde3820fe","assignerShortName":"dell","cveId":"CVE-2015-3190","datePublished":"2017-05-25T17:00:00.000Z","dateReserved":"2015-04-10T00:00:00.000Z","dateUpdated":"2024-08-06T05:39:31.774Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-05-25 17:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-601","Open redirect"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cloudfoundry:cf-release:*:*:*:*:*:*:*:*","versionEndIncluding":"209","matchCriteriaId":"D648E4CC-C6C7-4C5C-B554-528D4DBDC079"},{"vulnerable":true,"criteria":"cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*","versionEndIncluding":"1.4.5","matchCriteriaId":"AB6812A0-8836-4F25-9AC1-DB552BC605ED"},{"vulnerable":true,"criteria":"cpe:2.3:a:pivotal_software:cloud_foundry_uaa:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.6","matchCriteriaId":"D7981BF0-D4AF-4E06-96DE-725FE2D581A5"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3190","Ordinal":"1","Title":"CVE-2015-3190","CVE":"CVE-2015-3190","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3190","Ordinal":"1","NoteData":"With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.","Type":"Description","Title":"CVE-2015-3190"},{"CveYear":"2015","CveId":"3190","Ordinal":"2","NoteData":"2017-05-25","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3190","Ordinal":"3","NoteData":"2017-05-25","Type":"Other","Title":"Modified"}]}}}