PT-2023-5466 · Red Hat · 3Scale Admin Portal

Sandipan Roy · Publicado 2023-09-12 · Atualizado 2023-12-13 · CVE-2023-4910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3Scale Admin Portal (affected versions not specified)

Description A flaw was found in 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache, potentially allowing an attacker to disclose protected information.

Recommendations As a temporary workaround, consider clearing the browser cache after logging out from the personal tokens page to minimize the risk of exploitation. Restrict access to the personal tokens page until a patch is available. Avoid using the back button in the browser after logging out from the personal tokens page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

CWE-525

Identificadores relacionados

BDU:2023-06097

CVE-2023-4910

Produtos afetados

3Scale Admin Portal

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-4910 · Nota de Segurança
• https://t.me/cibsecurity/73614 · Publicação no Telegram
• https://t.me/cvenotify/63412 · Publicação no Telegram
• https://access.redhat.com/security/cve/CVE-2023-4910 · Aviso do Fabricante
• https://twitter.com/zeeshankghouri/status/1722108170968146174 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1701539262049472912 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-06097 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2023-4910 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2238498 · Nota
• https://osv.dev/vulnerability/CVE-2023-4910 · Aviso do Fabricante