LiveActive security incident?Get immediate response
CVE Record

CVE-2015-3191: With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier an...

With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue could let an attacker cause an email address change for a logged-in Cloud Foundry user through cross-site request forgery. Exposure is limited to older Cloud Foundry/UAA deployments using the UAA internal user store. Sources state SAML or LDAP integrated deployments are not affected.

Executive priority

Treat this as a targeted remediation item for legacy Cloud Foundry environments, not a broad emergency. Prioritize if internal UAA authentication is still used on affected versions.

Technical view

CVE-2015-3191 is a CSRF flaw in UAA's change_email form. It affects Cloud Foundry Runtime cf-release v209 or earlier, UAA Standalone 2.2.6 or earlier, and Pivotal Cloud Foundry Runtime 1.4.5 or earlier when internal UAA authentication is used.

Likely exposure

Likely exposure is older Cloud Foundry or Pivotal Cloud Foundry environments that still use UAA's internal user store. Deployments integrated with SAML or LDAP are described as not affected.

Exploitation context

The source describes a malicious-link scenario requiring a victim already logged into a Cloud Foundry instance. KEV is false, and the supplied sources do not report active exploitation.

Researcher notes

No CVSS, CWE, exploit status, or exact fixed version is included in the provided bundle. Analysis is constrained to the public CVE text and Pivotal advisory reference.

Mitigation direction

  • Check the Pivotal advisory and vendor guidance for fixed versions or supported upgrade paths.
  • Identify and prioritize affected Cloud Foundry Runtime and UAA Standalone versions.
  • Confirm whether authentication uses UAA internal user store, SAML, or LDAP.
  • For affected internal-store deployments, move off affected versions per vendor guidance.

Validation and detection

  • Inventory Cloud Foundry Runtime, Pivotal Cloud Foundry Runtime, and UAA Standalone versions.
  • Verify whether UAA internal user store authentication is enabled.
  • Confirm SAML or LDAP integration where deployments are expected to be unaffected.
  • Review UAA change_email handling for CSRF protections in affected deployments.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-3191 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
PivotalCloud FoundryRuntime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier, Runtime 1.4.5 or earlierListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.