CVE-2023-0456 Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check
Attackers can access unauthorized information by exploiting improper JWT token validation in the APICast proxy component of Red Hat 3scale.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0456?
CVE-2023-0456 is a high-severity authentication bypass vulnerability in Red Hat 3scale API Management Platform 2, published on 27 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
Which versions are affected by CVE-2023-0456?
It affects 1 product.
Products include Redhat Apicast.
How do I fix CVE-2023-0456?
No fix has been published for CVE-2023-0456 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-0456 being exploited?
There is no known exploitation of CVE-2023-0456 in the wild and no public exploit code.
Other vulnerabilities in Red Hat 3scale API Management Platform 2
Sources
Also known as GHSA-cwcc-8wqw-36gf.