CVE-2023-4910: falha de média gravidade em Red Hat 3scale API Management Platform 2
3scale-admin-portal: logged out users tokens can be accessed
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.2%
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Red Hat · Red Hat 3scale API Management Platform 2CVEs relacionadas — Red Hat 3scale API Management Platform 2
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.8%CVE-2026-92925HIGHRedis: redis: out-of-bounds read via crafted cluster bus packetsEPSS 0.7%CVE-2023-5349MEDIUMDraw while calling getdrawinfo()EPSS 0.7%CVE-2023-0456HIGHApicast proxies the api call with incorrect jwt token to the api backend without proper authorization checkEPSS 0.6%CVE-2024-0560MEDIUMApicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versionsEPSS 0.5%