CVE-2017-2773

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-13 · updated 2026-06-17
Weakness: CWE-20

Description

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue.

Affected products

PCF Elastic Runtime: 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5 (+117)

References

http://www.securityfocus.com/bid/97135
https://pivotal.io/security/cve-2017-2773
http://www.securityfocus.com/bid/97135
https://pivotal.io/security/cve-2017-2773

Get alerted when CVE-2017-2773 or the next vulnerability affects your stack