Multiple Pivotal Products CVE-2015-5170 Cross Site Request Forgery Vulnerability

Bugtraq ID:	101579
Class:	Design Error
CVE:	CVE-2015-5170
Remote:	Yes
Local:	No
Published:	Oct 26 2017 12:00AM
Updated:	Dec 19 2017 08:00PM
Credit:	Jay Patel
Vulnerable:	Pivotal UAA 3.2 Pivotal UAA 3.0 Pivotal UAA 2.0 Pivotal UAA 2.5.1 Pivotal Cloud Foundry Runtime 215 Pivotal Cloud Foundry Runtime 208 Pivotal Cloud Foundry Runtime 207 Pivotal Cloud Foundry Elastic Runtime 1.6.60 Pivotal Cloud Foundry Elastic Runtime 1.6.40 Pivotal Cloud Foundry Elastic Runtime 1.6.39 Pivotal Cloud Foundry Elastic Runtime 1.6.38 Pivotal Cloud Foundry Elastic Runtime 1.6.34 Pivotal Cloud Foundry Elastic Runtime 1.6.30 Pivotal Cloud Foundry Elastic Runtime 1.6.29 Pivotal Cloud Foundry Elastic Runtime 1.6.5 Pivotal Cloud Foundry Elastic Runtime 1.6 Pivotal Cloud Foundry Elastic Runtime 1.6.65 Pivotal Cloud Foundry Elastic Runtime 1.6.32
Not Vulnerable:	Pivotal UAA 2.5.2 Pivotal Cloud Foundry Runtime 216 Pivotal Cloud Foundry Elastic Runtime 1.7

Multiple Pivotal Products CVE-2015-5170 Cross Site Request Forgery Vulnerability

Multiple Pivotal Products are prone to an cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Multiple Pivotal Products CVE-2015-5170 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Multiple Pivotal Products CVE-2015-5170 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.