CVE Feed

    Dashboard / CVE / CVE-2017-7512

    CVE-2017-7512

    Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

    Published:Jul 6, 2017
    Last Modified:Apr 20, 2025
    EPS:Jul 7, 2017
    EPSS Score:0.00498
    CVSS Score:9.8

    Affected Products

    Vendor
    Redhat
    Product
    3scale Amp
    Vendor
    Redhat
    Product
    3scale Api Management Platform

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-3814 (CVSS 7.5) — It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses s…
    CVE-2021-3442 (CVSS 5.4) — A flaw was found in the Red Hat OpenShift API Management product. User input is not validated allowing an auth…
    CVE-2021-23017 (CVSS 7.7) — A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP pack…
    CVE-2020-26247 (CVSS 2.6) — Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nok…
    CVE-2020-8911 (CVSS 5.6) — A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows…
    CVE-2020-8912 (CVSS 2.5) — A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2…
    CVE-2020-14040 (CVSS 7.5) — The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 d…
    CVE-2019-14836 (CVSS 8.8) — A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login C…
    CVE-2020-9283 (CVSS 7.5) — golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verificat…
    CVE-2019-14849 (CVSS 5.4) — A vulnerability was found in 3scale before version 2.6, did not set the HTTPOnly attribute on the user session…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High