CRITICAL🇵🇱 Wersja polska

CVE-2017-2773

CVSS 9.8v3.0pub. 2017-06-13upd. 2026-05-13

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Pivotal Software Cloud Foundry Elastic Runtime

    APP
    Pivotal Software
    1.6.01.6.11.6.101.6.111.6.121.6.131.6.141.6.151.6.161.6.171.6.181.6.191.6.21.6.201.6.21+ 85 more
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2016-6658CRITICAL9.6PL ✓same product

Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release

CVE-2015-5172CRITICAL9.8PL ✓same product

Cloud Foundry: brak wygasania linków resetowania hasła

CVE-2015-5171CRITICAL9.8PL ✓same product

Cloud Foundry: brak unieważniania sesji po zmianie hasła

CVE-2017-4955CRITICAL9.8PL ✓same product

Pivotal PCF Elastic Runtime — dane uwierzytelniające ujawnione w logach

CVE-2016-0761CRITICAL9.8PL ✓same product

Podatność path traversal w Cloud Foundry Garden-Linux przy obsłudze obrazów Docker