CVE-2015-3190

EUVD-2015-3258
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 41%
Affected Products (NVD)
VendorProductVersion
cloudfoundrycf-release
𝑥
≤ 209
pivotal_softwarecloud_foundry_elastic_runtime
𝑥
≤ 1.4.5
pivotal_softwarecloud_foundry_uaa
𝑥
≤ 2.2.6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://pivotal.io/security/cve-2015-3190
https://pivotal.io/security/cve-2015-3190