CVE-2021-3814
published 2022-03-25CVE-2021-3814: It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.11%
62.3th percentile
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | 3scale | < 2.11.0 | 2.11.0 |
| redhat | 3scale | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-46fh-44xx-6xgh: It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead
ghsa_unreviewed·2022-03-26
CVE-2021-3814 [HIGH] CWE-862 GHSA-46fh-44xx-6xgh: It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.
Red Hat
3scale: missing validation of access token
vendor_redhat·2021-09-22·CVSS 7.5
CVE-2021-3814 [HIGH] CWE-862 3scale: missing validation of access token
3scale: missing validation of access token
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.
A flaw was found in 3scale's API docs, where it does not validate the access token. In the case of an invalid token, it uses session auth instead. This issue possibly bypasses access controls and permits unauthorized information disclosure.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-25
Published