Back
CVE-2015-3189
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime…
Low3.7EPSS 0.82%
- Published
- Updated
- Reserved
- Assigned by
- dell
Description
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Low3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.82% · top 43% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.
Weakness
- Password reset weakness
- CWE-640 (opens in a new tab)All about CWE-640 and its CVEs
Affected products
- affected Runtime cf-release versions v208 or earlier
- affected UAA Standalone versions 2.2.5 or earlier
- affected Runtime 1.4.5 or earlier
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.cloudfoundry.identity:cloudfoundry-identity-serverGHSA-fj69-p8f6-q97h (opens in a new tab)
References (1)
- https://pivotal.io/security/cve-2015-3189 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-fj69-p8f6-q97h (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2015-3189)Record last updated .