CVE-2015-5173: Cloudfoundry Cf-Release

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."

Affected products

• Cloudfoundry Cf-Release: before 216 (fixed in 216)
• Pivotal Software Cloud Foundry Elastic Runtime: before 1.7.0 (fixed in 1.7.0)
• Pivotal Software Cloud Foundry Uaa: before 2.5.2 (fixed in 2.5.2)

Published 2017-10-24. Last modified 2026-06-17.