PT-2021-11165 · Red Hat · Red Hat 3Scale

Chess Hazlett · Published 2021-05-26 · Updated 2022-10-21 · CVE-2020-25634

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Red Hat 3scale versions prior to 3scale-2.10.0-ER1

Description: A flaw was found in Red Hat 3scale’s API documentation URL, allowing access without credentials. This issue enables an attacker to view sensitive information or modify service APIs.

Recommendations: For versions prior to 3scale-2.10.0-ER1, update to version 3scale-2.10.0-ER1 or later to resolve the issue. As a temporary workaround, consider restricting access to the API documentation URL to minimize the risk of exploitation.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2020-25634

Affected Products

Red Hat 3Scale

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-25634 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25634 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1880201 · Vendor Advisory