PT-2021-13858 · Red Hat · Red Hat 3Scale Api Management Platform 2

Chess Hazlett · Published 2021-02-23 · Updated 2021-02-27 · CVE-2021-20252

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Red Hat 3scale API Management Platform 2

Description: A flaw was found in the 3scale backend, which does not perform preventive handling on user-requested date ranges in certain queries. This allows a malicious authenticated user to submit a request with a sufficiently large date range, eventually yielding an internal server error and resulting in denial of service. The highest threat from this issue is to system availability.

Recommendations: For Red Hat 3scale API Management Platform 2, consider implementing preventive handling on user-requested date ranges in certain queries to prevent malicious users from submitting requests that could lead to an internal server error. As a temporary workaround, restrict the size of date ranges that can be submitted by users to minimize the risk of denial of service.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-20252

Affected Products

Red Hat 3Scale Api Management Platform 2

References · 5

• https://bugzilla.redhat.com/show_bug.cgi?id=1928302 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20252 · Security Note
• https://t.me/cibsecurity/24050 · Telegram Post
• https://t.me/cvenotify/10404 · Telegram Post