CVE-2017-4959
HighSummary
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.8.x prior to 1.8.29 and 1.9.x prior to 1.9.7, allowing an authorized user to take over another user's account. This can lead to account lockout and potential privilege escalation.
Risk Assessment
Organizations using Pivotal Cloud Foundry may be exposed to unauthorized access to user accounts, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to versions 1.8.29 or 1.9.7 to mitigate this vulnerability and to monitor user account activity.
Other vulnerabilities in Pivotal PCF Elastic Runtime
See all- CVE-2017-4955Critical
An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.6.x prior to 1.6.65, 1.7.x prior to 1.7.48, 1.8.x prior to 1.8.28, and 1.9.x prior to 1.9.5, where several credentials were present in the logs for the Notifications errand.
- CVE-2017-2773Critical
An issue in Pivotal PCF Elastic Runtime allows unprivileged attackers to impersonate other users due to incomplete validation in JSON Web Token (JWT) libraries. This affects versions 1.6.x prior to 1.6.60, 1.7.x prior to 1.7.41, 1.8.x prior to 1.8.23, and 1.9.x prior to 1.9.1.
Original NVD description (English source)
An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7. Pivotal Cloud Foundry deployments using the Pivotal Account application are vulnerable to a flaw which allows an authorized user to take over the account of another user, causing account lockout and potential escalation of privileges.