PT-2022-13870 · Red Hat · 3Scale Api Management 2

Chess Hazlett · Published 2022-10-19 · Updated 2025-05-09 · CVE-2022-1414

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3scale API Management 2

Description The issue arises from inadequate sanitation of user input in multiple fields, allowing an authenticated user to inject scripts. This could potentially lead to access to sensitive information or further attacks.

Recommendations For 3scale API Management 2, ensure proper sanitation of user input in all fields to prevent script injection. As a temporary workaround, consider restricting access to sensitive information and monitoring for suspicious activity until a more permanent solution is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1173

CWE-20

Related Identifiers

CVE-2022-1414

Affected Products

3Scale Api Management 2

References · 6

• https://osv.dev/vulnerability/CVE-2022-1414 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-1414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1414 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2076794 · Vendor Advisory
• https://t.me/cvenotify/121577 · Telegram Post
• https://t.me/cibsecurity/51827 · Telegram Post