CVEvulnerability

CVE-2021-3814

7.5 HIGH Published 2022-03-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-862

Description

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

Affected configurations

• redhat 3scale (< 2.11.0)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References