CVE-2021-3412 Security feature bypass in 3Scale
Attackers can bypass login controls via brute force due to missing protections, potentially accessing privileged information or taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3412?
CVE-2021-3412 is a high-severity vulnerability in 3Scale, published on 1 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap to bypass login controls, and access privileged information, or possibly conduct further attacks.
Weakness: CWE-307
Which versions are affected by CVE-2021-3412?
It affects 2 products.
Products include Redhat 3scale, Redhat 3scale Api Management.
How do I fix CVE-2021-3412?
No fix has been published for CVE-2021-3412 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-3412 being exploited?
There is no known exploitation of CVE-2021-3412 in the wild and no public exploit code.
Other vulnerabilities in 3Scale
Sources
Also known as GHSA-jh24-r4rp-jw9m.