CVE-2017-2773
CriticalSummary
An issue in Pivotal PCF Elastic Runtime allows unprivileged attackers to impersonate other users due to incomplete validation in JSON Web Token (JWT) libraries. This affects versions 1.6.x prior to 1.6.60, 1.7.x prior to 1.7.41, 1.8.x prior to 1.8.23, and 1.9.x prior to 1.9.1.
Risk Assessment
The organization may be exposed to attacks where unauthorized users can access other users' data, leading to privacy and security breaches.
Recommendation
It is recommended to update Pivotal PCF Elastic Runtime to the latest version to mitigate this vulnerability and implement additional security measures to protect against unauthorized access.
Other vulnerabilities in Pivotal PCF Elastic Runtime
See all- CVE-2017-4959High
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.8.x prior to 1.8.29 and 1.9.x prior to 1.9.7, allowing an authorized user to take over another user's account. This can lead to account lockout and potential privilege escalation.
- CVE-2017-4955Critical
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.6.x prior to 1.6.65, 1.7.x prior to 1.7.48, 1.8.x prior to 1.8.28, and 1.9.x prior to 1.9.5, where several credentials were present in the logs for the Notifications errand.
Original NVD description (English source)
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.