Red Hat 3scale Api Management
Recent Red Hat 3scale Api Management Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2021:5191 | (RHSA-2021:5191) Moderate: Red Hat 3scale API Management 2.11.1 Release - Container Images | December 16, 2021 |
| RHSA-2021:3851 | (RHSA-2021:3851) Important: Red Hat 3scale API Management 2.11.0 Release - Container Images | October 14, 2021 |
By the Year
In 2024 there have been 0 vulnerabilities in Red Hat 3scale Api Management . Last year 3scale Api Management had 1 security vulnerability published. Right now, 3scale Api Management is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 1 | 5.50 |
| 2022 | 2 | 7.90 |
| 2021 | 5 | 6.60 |
| 2020 | 0 | 0.00 |
| 2019 | 2 | 8.30 |
| 2018 | 0 | 0.00 |
It may take a day or so for new 3scale Api Management vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat 3scale Api Management Security Vulnerabilities
A flaw was found In 3Scale Admin Portal
CVE-2023-4910
5.5 - Medium
- November 06, 2023
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
Exposure of Resource to Wrong Sphere
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields
CVE-2022-1414
8.8 - High
- October 19, 2022
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.
Improper Input Validation
.A flaw was found in the
CVE-2021-3609
7 - High
- March 03, 2022
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
Race Condition
A flaw was found in the Red Hat 3scale API Management Platform
CVE-2020-14388
6.3 - Medium
- June 02, 2021
A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforced. This flaw allows an authenticated user to bypass normal account restrictions and access API services where they do not have permission.
It was found that all versions of 3Scale developer portal lacked brute force protections
CVE-2021-3412
7.3 - High
- June 01, 2021
It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.
Improper Restriction of Excessive Authentication Attempts
A flaw was found in Red Hat 3scales API docs URL, where it is accessible without credentials
CVE-2020-25634
5.4 - Medium
- May 26, 2021
A flaw was found in Red Hat 3scales API docs URL, where it is accessible without credentials. This flaw allows an attacker to view sensitive information or modify service APIs. Versions before 3scale-2.10.0-ER1 are affected.
Missing Authentication for Critical Function
A flaw was found in 3scales APIcast gateway that enabled the TLS 1.0 protocol
CVE-2019-14852
7.5 - High
- March 18, 2021
A flaw was found in 3scales APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue.
Use of a Broken or Risky Cryptographic Algorithm
A flaw was found in Red Hat 3scale API Management Platform 2
CVE-2021-20252
6.5 - Medium
- February 23, 2021
A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.
Improper Input Validation
In ghostscript before version 9.50
CVE-2019-10216
7.8 - High
- November 27, 2019
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Improper Privilege Management
A flaw was found in all versions of ghostscript 9.x before 9.50
CVE-2019-14869
8.8 - High
- November 15, 2019
A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.
Improper Privilege Management
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux Workstation or by Red Hat? Click the Watch button to subscribe.
