TI-2022-18247 CVE-2022-38723 · GHSA-vp62-m958-qj8c
Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
Priority MEDIUM 45
Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
Gravitee
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Gravitee records in CISA KEVNo Gravitee vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records
TI-2020-20045 CVE-2020-37281 · GHSA-vh3j-3qjc-g47j
Gravitee API Management bypass authentication via default JWT secret
Priority MEDIUM 43
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret.
TI-2019-15214 CVE-2019-25075 · GHSA-xc4w-28g8-vqm5
HTML injection combined with path traversal in the Email service in Gravitee API…
Priority LOW 28
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.