// For flags

CVE-2023-0456

Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

Se encontró una falla en APICast, cuando el módulo OIDC de 3Scale no evalúa adecuadamente la respuesta a un token no coincidente de un dominio separado. Esto podría permitir que un atacante pueda acceder a un dominio separado, lo que permitiría el acceso a información no autorizada.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-01-24 CVE Reserved
  • 2023-09-27 CVE Published
  • 2024-09-24 CVE Updated
  • 2024-09-24 First Exploit
  • 2024-10-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-285: Improper Authorization
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
 Apicast
Search vendor "Redhat" for product "Apicast"
 < 2.12.2
Search vendor "Redhat" for product "Apicast" and version " < 2.12.2"
-
Affected
Redhat
Search vendor "Redhat"
 Apicast
Search vendor "Redhat" for product "Apicast"
 >= 2.13.0 < 2.13.2
Search vendor "Redhat" for product "Apicast" and version " >= 2.13.0 < 2.13.2"
-
Affected