CVE-2019-14836 Cross-site request forgery in Red Hat 3scale API Management

What is CVE-2019-14836?

CVE-2019-14836 is a high-severity vulnerability in Red Hat 3scale API Management, published on 26 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. An attacker could use this flaw to access unauthorized information or conduct further attacks.

Weakness: CWE-352

Which versions are affected by CVE-2019-14836?

It affects 1 product.

Products include Redhat 3scale.

How do I fix CVE-2019-14836?

No fix has been published for CVE-2019-14836 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-14836 being exploited?

There is no known exploitation of CVE-2019-14836 in the wild and no public exploit code.

Other vulnerabilities in Red Hat 3scale API Management

• CVE-2021-3814 Auth bypass in 3scale High 7.5
• CVE-2021-3412 Security feature bypass in 3Scale High 7.3
• CVE-2024-0560 Auth bypass in Red Hat 3scale API Management Platform 2 Medium 6.3
• CVE-2020-25634 Missing authorization in 3scale-system Medium 5.4
• CVE-2019-14849 Cross-site scripting in 3scale Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9wj3-35xv-c6hq.