CVE-2017-2773

CRITICAL

PCF Elastic Runtime <1.6.60/1.7.41/1.8.23/1.9.1 - Unauthenticated JWT Impersonation

Title source: llm
STIX 2.1

Description

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97135
Mitigation, Vendor Advisory x_refsource_confirm
https://pivotal.io/security/cve-2017-2773

Scores

CVSS v3 9.8
EPSS 0.0213
EPSS Percentile 79.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (50)
n/a/PCF Elastic Runtime PCF Elastic Runtime
pivotal_software/cloud_foundry_elastic_runtime 1.6.0
pivotal_software/cloud_foundry_elastic_runtime 1.6.1
pivotal_software/cloud_foundry_elastic_runtime 1.6.2
pivotal_software/cloud_foundry_elastic_runtime 1.6.3
pivotal_software/cloud_foundry_elastic_runtime 1.6.4
pivotal_software/cloud_foundry_elastic_runtime 1.6.5
pivotal_software/cloud_foundry_elastic_runtime 1.6.6
pivotal_software/cloud_foundry_elastic_runtime 1.6.7
pivotal_software/cloud_foundry_elastic_runtime 1.6.8
... and 40 more
Published Jun 13, 2017
Tracked Since Feb 18, 2026