PT-2021-20385 · Unknown · 3Scale Developer Portal

Chess Hazlett · Published 2021-06-01 · Updated 2022-06-03 · CVE-2021-3412

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: 3Scale developer portal versions (all versions)

Description: The issue is related to the lack of brute force protections in the 3Scale developer portal. This gap allows an attacker to bypass login controls, access privileged information, or possibly conduct further attacks.

Recommendations: For all versions, consider implementing brute force protection mechanisms to prevent unauthorized access. As a temporary workaround, restrict access to sensitive information and privileged areas of the portal until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-3412

Affected Products

3Scale Developer Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-3412 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1928301 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3412 · Vendor Advisory
• https://t.me/cvenotify/17223 · Telegram Post