CVE-2017-2773

9.8 criticalEPSS 2.1%

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-06-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pivotal_software:cloud_foundry_elastic_runtime

References

http://www.securityfocus.com/bid/97135
https://pivotal.io/security/cve-2017-2773
http://www.securityfocus.com/bid/97135
https://pivotal.io/security/cve-2017-2773

Check your stack JSON