PT-2017-17782 · Red Hat+1 · 3Scale Api Management Platform+1

Chess Hazlett + 1 · Publicado 2017-07-07 · Atualizado 2019-10-03 · CVE-2017-7512

NVD

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2017-7512

MGASA-2017-0224

Produtos afetados

3Scale Api Management Platform

Openvpn

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-7512 · Nota de Segurança
• https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 · Nota
• https://advisories.mageia.org/MGASA-2017-0224.html · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1457997 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2017-7512 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1712 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-security-announce/2017-06/msg00027.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=21125 · Nota
• https://osv.dev/vulnerability/MGASA-2017-0224 · Aviso do Fabricante
• https://ubuntu.com/usn/usn-3339-1 · Aviso do Fabricante