Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2023-0456

Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a apicast

  • 2.13.2unaffected
  • 2.14.0unaffected
  • 2.12.2unaffected

Red Hat Red Hat 3scale API Management Platform 2

Default version status: affected

References