CVE-2021-20252 Denial of service in 3scale/backend
An authenticated user can cause a denial of service in the 3scale backend by submitting requests with excessively large date ranges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20252?
CVE-2021-20252 is a medium-severity denial of service vulnerability in 3scale/backend, published on 23 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested date ranges in certain queries allowing a malicious authenticated user to submit a request with a sufficiently large date range to eventually yield an internal server error resulting in denial of service. The highest threat from this vulnerability is to system availability.
Weakness: CWE-20
Which versions are affected by CVE-2021-20252?
It affects 1 product.
Products include Redhat 3scale Api Management.
How do I fix CVE-2021-20252?
No fix has been published for CVE-2021-20252 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20252 being exploited?
There is no known exploitation of CVE-2021-20252 in the wild and no public exploit code.
Other vulnerabilities in 3scale/backend
- CVE-2022-1414 Cross-site scripting in 3scale-amp-system
- CVE-2024-10295 Auth bypass in Red Hat 3scale API Management Platform 2
- CVE-2019-14852 A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol.
- CVE-2020-14388 Missing authorization in Red Hat 3scale API Management
- CVE-2023-4910 3scale-admin-portal: logged out users tokens can be accessed
Sources
Also known as GHSA-qjp3-fvjv-f8w7.