CVE-2021-3814CWE-862

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead

published March 25, 2022

CVSS
—
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01158 · 66.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-03-25T18:02Z
EPSS history
Timeline
  • 25 MAR 18:02Z
    It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead
    cvelistv5