1. Home
  2. CVE Database
  3. CVE-2021-3814
HIGH · 7.5

CVE-2021-3814

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized in...

Vulnerability Description

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized information disclosure.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Redhat3Scale< 2.11.0

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2021-3814?

CVE-2021-3814 is a vulnerability with a CVSS score of 7.5 (HIGH). It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead. This conceivably bypasses access controls and permits unauthorized in...

How severe is CVE-2021-3814?

CVE-2021-3814 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-3814?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat 3Scale.