Advisories · Technology
Red Hat 3scale API Management Platform 2.
Every CVE that names Red Hat 3scale API Management Platform 2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Redis: redis: out-of-bounds read via crafted cluster bus packets
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Memory corruption
- CVSS 7.5 High
3scale-porta: readonly fields not validated server-side
- 3scale porta
- Red Hat 3scale API Management Platform 2
- CWE-281
- CVSS 7.5 High
Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request
- Red Hat 3scale API Management Platform 2
- Broken access control
- CVSS 5.3 Medium
System: pdf invoices of the developer users can be seen if the url is known
- Red Hat 3scale API Management Platform 2
- Broken access control
- CVSS 6.3 Medium
Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
- Red Hat 3scale API Management Platform 2
- CWE-280
- CVSS 5.5 Medium
3scale-admin-portal: logged out users tokens can be accessed
- Red Hat 3scale API Management Platform 2
- Information disclosure
- CVSS 7.4 High
Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check
- apicast
- Red Hat 3scale API Management Platform 2
- Broken access control