With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions prior to 2.2.5 and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new one. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

Affected Packages

Maven org.cloudfoundry.identity:cloudfoundry-identity-server

Affected versions: 0 (fixed in 2.2.5)

Related CVEs

CVE-2015-3189

Key Information

GHSA ID

GHSA-fj69-p8f6-q97h

Published

May 13, 2022 1:07 AM

Last Modified

February 28, 2024 6:38 PM

CVSS Score

2.5 /10

Primary Ecosystem

Maven

Primary Package

org.cloudfoundry.identity:cloudfoundry-identity-server

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 5, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.