CVE-2015-5172: Cloudfoundry Cf-Release

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

Affected products

• Cloudfoundry Cf-Release: before 216 (fixed in 216)
• Pivotal Software Cloud Foundry Elastic Runtime: before 1.7.0 (fixed in 1.7.0)
• Pivotal Software Cloud Foundry Uaa: before 2.5.2 (fixed in 2.5.2)

Published 2017-10-24. Last modified 2026-06-17.