CVE-2024-9671 — System: pdf invoices of the developer users can be seen if the url is known

CVE-2024-9671

System: pdf invoices of the developer users can be seen if the url is known PUBLISHED

Description (CNA)

A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 2.13.0 before 2.13.6; affected 2.14.0
Red Hat / Red Hat 3scale API Management Platform 2	affected

CWE

CWE-862

References

https://access.redhat.com/security/cve/CVE-2024-9671
https://bugzilla.redhat.com/show_bug.cgi?id=2317449

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.