CVE-2017-2773
CriticalSummary
An issue in Pivotal PCF Elastic Runtime allows unprivileged attackers to impersonate other users due to incomplete validation in JSON Web Token (JWT) libraries. This affects versions 1.6.x prior to 1.6.60, 1.7.x prior to 1.7.41, 1.8.x prior to 1.8.23, and 1.9.x prior to 1.9.1.
Risk Assessment
The organization may be exposed to attacks where unauthorized users can access other users' data, leading to privacy and security breaches.
Recommendation
It is recommended to update Pivotal PCF Elastic Runtime to the latest version to mitigate this vulnerability and implement additional security measures to protect against unauthorized access.
Original NVD description (English source)
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.