VulnerabilityModified
CVE-2022-1414
An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.
HIGH 8.8EPSS 0.81%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1173, CWE-20
- Affected
- redhat/3scale api management
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/CVE-2022-1414Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2076794Issue Tracking, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-1414Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2076794Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.