PT-2021-8986 · Red Hat · 3Scale Api Management Platform

Chess Hazlett · Published 2021-03-18 · Updated 2021-06-04 · CVE-2019-14852

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3scale API Management Platform (affected versions not specified)

Description A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2019-14852

Affected Products

3Scale Api Management Platform

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-14852 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14852 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1758208 · Note
• https://t.me/cibsecurity/25152 · Telegram Post
• https://t.me/cvenotify/11921 · Telegram Post
• https://t.me/cvenotify/15541 · Telegram Post