CVE-2024-12125: falha de alta gravidade em 3scale porta
3scale-porta: readonly fields not validated server-side
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.3%
A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVEs relacionadas — 3scale porta
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2025-49794CRITICALLibxml: heap use after free (uaf) leads to denial of service (dos)EPSS 0.8%CVE-2026-92925HIGHRedis: redis: out-of-bounds read via crafted cluster bus packetsEPSS 0.7%CVE-2023-5349MEDIUMDraw while calling getdrawinfo()EPSS 0.7%CVE-2023-0456HIGHApicast proxies the api call with incorrect jwt token to the api backend without proper authorization checkEPSS 0.6%CVE-2024-0560MEDIUMApicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versionsEPSS 0.5%