PT-2017-17782 · Red Hat+1 · 3Scale Api Management Platform+1

Chess Hazlett + 1 · Published 2017-07-07 · Updated 2019-10-03 · CVE-2017-7512

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-7512

MGASA-2017-0224

Affected Products

3Scale Api Management Platform

Openvpn

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-7512 · Security Note
• https://advisories.mageia.org/MGASA-2017-0224.html · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1457997 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2017-7512 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1712 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0224 · Vendor Advisory
• https://ubuntu.com/usn/usn-3339-1 · Vendor Advisory
• https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243 · Note
• https://lists.opensuse.org/opensuse-security-announce/2017-06/msg00027.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=21125 · Note