CVE-2023-0456 — Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check

CVE-2023-0456

Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check PUBLISHED

Description (CNA)

A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

Affected (CNA)

Vendor / product	Versions
n/a / apicast	unaffected 2.13.2; unaffected 2.14.0; unaffected 2.12.2
Red Hat / Red Hat 3scale API Management Platform 2	affected

CWE

CWE-285

References

https://access.redhat.com/security/cve/CVE-2023-0456
https://bugzilla.redhat.com/show_bug.cgi?id=2163586

ADP enrichment

CVE

No English description supplied.

https://access.redhat.com/security/cve/CVE-2023-0456
https://bugzilla.redhat.com/show_bug.cgi?id=2163586

CISA-ADP

No English description supplied.

No references supplied.