Skip to content
Sign in
7.4 High

CVE-2023-0456 A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token…

Description

A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

Affected products and versions

Product Affected versions Fixed in
apicast 2.14 earliest → < 2.14.0 2.14.0
apicast 2.13 earliest → < 2.13.2 2.13.2
apicast 2.12 earliest → < 2.12.2 2.12.2
Red Hat 3scale API Management Platform 2 Versions not published

Other CVEs of apicast

The 3 CVEs of apicast →
CVE-2021-3523 A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse Not rated CVE-2019-14852 A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol Not rated
Track this CVE