VulnerabilityModified
CVE-2021-3523
This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address.
HIGH 7.5EPSS 0.84%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.84%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-281
- Affected
- redhat/apicast
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1954805Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954805Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.