CVE-2023-4910 3scale-admin-portal: logged out users tokens can be accessed
Logged-out users can access personal API tokens via browser cache, exposing sensitive credentials to anyone with physical access to the device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4910?
CVE-2023-4910 is a medium-severity vulnerability in Red Hat 3scale API Management Platform 2, published on 6 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache.
Weakness: CWE-668
Which versions are affected by CVE-2023-4910?
It affects 1 product.
Products include Redhat 3scale Api Management.
How do I fix CVE-2023-4910?
No fix has been published for CVE-2023-4910 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-4910 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4910 exists.
Other vulnerabilities in Red Hat 3scale API Management Platform 2
- CVE-2022-1414 Cross-site scripting in 3scale-amp-system
- CVE-2024-10295 Auth bypass in Red Hat 3scale API Management Platform 2
- CVE-2019-14852 A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol.
- CVE-2021-20252 Denial of service in 3scale/backend
- CVE-2020-14388 Missing authorization in Red Hat 3scale API Management
Sources
Also known as GHSA-g849-x577-8j36.