PT-2023-5466 · Red Hat · 3Scale Admin Portal

Sandipan Roy · Published 2023-09-12 · Updated 2023-12-13 · CVE-2023-4910

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 3Scale Admin Portal (affected versions not specified)

Description A flaw was found in 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache, potentially allowing an attacker to disclose protected information.

Recommendations As a temporary workaround, consider clearing the browser cache after logging out from the personal tokens page to minimize the risk of exploitation. Restrict access to the personal tokens page until a patch is available. Avoid using the back button in the browser after logging out from the personal tokens page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-525

Related Identifiers

BDU:2023-06097

CVE-2023-4910

Affected Products

3Scale Admin Portal

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-4910 · Security Note
• https://access.redhat.com/security/cve/CVE-2023-4910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06097 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4910 · Vendor Advisory
• https://t.me/cibsecurity/73614 · Telegram Post
• https://t.me/cvenotify/63412 · Telegram Post
• https://twitter.com/zeeshankghouri/status/1722108170968146174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1701539262049472912 · Twitter Post
• https://access.redhat.com/security/cve/cve-2023-4910 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2238498 · Note